The 10 Tell-Tale Signs of Deception

The Words Reveal

By Paul M. Clikeman, Ph.D., CFE

JanFeb-number-10  Suspects and witnesses often reveal more than they intend through their choices of words. Here are ways to detect possible deception in written and oral statements.

The manager of a fast food restaurant calls the police late at night to report that an armed robber had entered the restaurant while the manager was alone in the office finishing some paperwork. The manager said the gunman had stolen the entire day's cash receipts — a little more than $4,000. The manager had reported a similar robbery at the restaurant about six months earlier. No other witnesses were present at either alleged robbery. The restaurant owner learns from police investigators that armed robbery is extremely unusual in the surrounding neighborhood. Also, the owner knows that the manager's wages have been garnished for the last year for nonpayment of child support. The owner hires you, a CFE, to investigate whether the manager is filing false police reports to cover his thefts. You begin your investigation by asking the manager to write a description of the evening's events.


Linguistic text analysis involves studying the language, grammar and syntax a subject uses to describe an event to detect any anomalies. Experienced investigators are accustomed to studying interview subjects' nonverbal behavior, such as eye contact and hand movement. Text analysis, on the other hand, considers only the subject's verbal behavior. Because text analysis evaluates only the subject's words, investigators can apply it to written as well as oral statements. In fact, many investigators prefer to analyze suspects' written statements for signs of deception before conducting face-to-face interviews.

Text analysis is based on research originating in the 1970s. Psychologists and linguists studied the language and word choices of subjects in controlled experiments and found predictable differences between truthful and deceptive statements. Susan Adams, an instructor who taught text analysis (which she called statement analysis) at the FBI Academy for many years, described it as a two-part process ("Statement Analysis: What Do Suspects' Words Really Reveal?" FBI Law Enforcement Journal, October 1996). First, investigators determine what is typical of a truthful statement. Secondly, they look for deviations from the norm.

The following section describes deviations that suggest a subject may be withholding, altering or fabricating information.


1. Lack of self-reference
Truthful people make frequent use of the pronoun "I" to describe their actions: "I arrived home at 6:30. The phone was ringing as I unlocked the front door, so I walked straight to the kitchen to answer it. I talked to my mother for 10 minutes before noticing that my TV and computer were missing from the living room." This brief statement contains the pronoun "I" four times in three sentences.

Deceptive people often use language that minimizes references to themselves. One way to reduce self-references is to describe events in the passive voice.


  •  "The safe was left unlocked" rather than "I left the safe unlocked." 
  •  "The shipment was authorized" rather than "I authorized the shipment." 


Another way to reduce self-references is to substitute the pronoun "you" for "I." 

Question: "Can you tell me about reconciling the bank statement?"

Answer: "You know, you try to identify all the outstanding checks and deposits in transit, but sometimes when you're really busy you just post the differences to the suspense account."

In oral statements and informal written statements, deceptive witnesses sometimes simply omit self-referencing pronouns. Consider this statement by a husband who claims his wife was killed accidently: "I picked up the gun to clean it. Moved it to the left hand to get the cleaning rod. Something bumped the trigger. The gun went off, hitting my wife." The husband acknowledges in the first sentence that he picked up the gun. But the second sentence is grammatically incomplete; "I" has been omitted from the beginning of the sentence. In the third sentence, "something" rather than "I" bumped the trigger. The statement also contains few personal possessive pronouns. The witness refers to "the" gun and "the" left hand where we might expect "my" to be used.

2. Verb tense.
Truthful people usually describe historical events in the past tense. Deceptive people sometimes refer to past events as if the events were occurring in the present. Describing past events using the present tense suggests that people are rehearsing the events in their mind. Investigators should pay particular attention to points in a narrative at which the speaker shifts to inappropriate present tense usage. Consider the following statement made by an employee claiming that a pouch containing $6,000 in cash was stolen before she could deposit it at the bank (I have emphasized certain words.):

"After closing the store, I put the cash pouch in my car and drove to the Olympia Bank building on Elm Street. It was raining hard so I had to drive slowly. I entered the parking lot and drove around back to the night depository slot. When I stopped the car and rolled down my window, a guy jumps out of the bushes and yells at me. I can see he has a gun. He grabs the cash pouch and runs away. The last I saw him he was headed south on Elm Street. After he was gone, I called the police on my cell phone and reported the theft."

The first three sentences describe the employee's drive to the bank in the past tense. But the next three sentences describe the alleged theft in the present tense. An alert investigator might suspect that the employee stole the day's cash receipts, then drove to the bank and called the police from the bank parking lot to report a phony theft. (See another example in "Antics with Semantics" at bottom.)

3. Answering questions with questions
Even liars prefer not to lie. Outright lies carry the risk of detection. Before answering a question with a lie, a deceptive person will usually try to avoid answering the question at all. One common method of dodging questions is to respond with a question of one's own. Investigators should be alert to responses such as:


  • "Why would I steal from my own brother?" 
  •  "Do I seem like the kind of person who would do something like that?" 
  •  "Don't you think somebody would have to be pretty stupid to remove cash from their own register drawer?" 


4. Equivocation
The subject avoids an interviewer's questions by filling his or her statements with expressions of uncertainty, weak modifiers and vague expressions. Investigators should watch for words such as: think, guess, sort of, maybe, might, perhaps, approximately, about, could. Vague statements and expressions of uncertainty allow a deceptive person leeway to modify his or her assertions at a later date without directly contradicting the original statement.

Noncommittal verbs are: think, believe, guess, suppose, figure, assume. Equivocating adjectives and adverbs are: sort of, almost, mainly, perhaps, maybe, about. Vague qualifiers are: you might say, more or less.

5. Oaths
Although deceptive subjects attempt to give interviewers as little useful information as possible, they try very hard to convince interviewers that what they say is true. Deceptive subjects often use mild oaths to try to make their statements sound more convincing. Deceptive people are more likely than truthful people to sprinkle their statements with expressions such as: "I swear," "on my honor," "as God is my witness," "cross my heart." Truthful witnesses are more confident that the facts will prove the veracity of their statements and feel less need to back their statements with oaths.

6. Euphemisms
Many languages offer alternative terms for almost any action or situation. Statements made by guilty parties often include mild or vague words rather than their harsher, more explicit synonyms. Euphemisms portray the subject's behavior in a more favorable light and minimize any harm the subject's actions might have caused. Investigators should look for euphemistic terms such as: "missing" instead of "stolen," "borrowed" instead of "took," "bumped" instead of "hit," and "warned" instead of "threatened."

7. Alluding to actions
People sometimes allude to actions without saying they actually performed them. Consider the following statement from an employee who was questioned about the loss of some valuable data: "I try to back up my computer and put away my papers every night before going home. Last Tuesday, I decided to copy my files onto the network drive and started putting my papers in my desk drawer. I also needed to lock the customer list in the office safe." Did the employee back up her computer? Did she copy her files onto the network drive? Did she put her papers in the desk drawer? Did she lock the customer list in the office safe? The employee alluded to all these actions without saying definitively that she completed any of them. An attentive investigator should not assume that subjects perform every action they allude to.

8. Lack of Detail
Truthful statements usually contain specific details, some of which may not even be relevant to the question asked. This happens because truthful subjects are retrieving events from long-term memory, and our memories store dozens of facts about each experience — the new shoes we were wearing, the song that was playing in the background, the woman at the next table who reminded us of our third-grade teacher, the conversation that was interrupted when the fire alarm rang. At least some of these details will show up in a truthful subject's statement.

Those who fabricate a story, however, tend to keep their statements simple and brief. Few liars have sufficient imagination to make up detailed descriptions of fictitious events. Plus, a deceptive person wants to minimize the risk that an investigator will discover evidence contradicting any aspect of his or her statement; the fewer facts that might be proved false, the better. Wendell Rudacille, the author of "Identifying Lies in Disguise" (Kendall/Hunt, 1994), refers to seemingly inconsequential details as "tangential verbal data" and considers their presence to be prime indicators that subjects are telling the truth.

9. Narrative balance
A narrative consists of three parts: prologue, critical event and aftermath. The prologue contains background information and describes events that took place before the critical event. The critical event is the most important occurrence in the narrative. The aftermath describes what happened after the critical event. In a complete and truthful narrative, the balance will be approximately 20 percent to 25 percent prologue, 40 percent to 60 percent critical event and 25 percent to 35 percent aftermath. If one part of the narrative is significantly shorter than expected, important information may have been omitted. If one part of the narrative is significantly longer than expected, it may be padded with false information. The following statement, filed with an insurance claim, is suspiciously out of balance:

"I was driving east on Elm Street at about 4:00 on Tuesday. I was on my way home from the A&P supermarket. The traffic light at the intersection of Elm and Patterson was red, so I came to a complete stop. After the light turned green, I moved slowly into the intersection. All of a sudden, a car ran into me. The other driver didn't stop, so I drove home and called my insurance agent."

The subject's statement contains four sentences of prologue, only one sentence describing the critical event, and only one sentence of aftermath. The prologue contains a credible amount of detail: the day and time of the accident, the driver's destination, and the location of the accident. But the description of the critical event (i.e., the alleged accident) is suspiciously brief. The claimant did not describe the other vehicle, which direction it came from, how fast it was going, whether the driver braked to try to avoid the accident or how the two vehicles made contact.

The aftermath is also shorter than one would expect from a complete and truthful account of a two-car accident. The claimant does not say which direction the other vehicle went after leaving the scene of the accident. He does not mention getting out of his vehicle to inspect the damage nor does he say whether he spoke to any people in the area who may have witnessed the accident. A claims adjuster receiving such a statement would be wise to investigate whether the policyholder concocted a phony hit-and-run story to collect for damages caused by the driver's negligence.

10. Mean Length of Utterance
The average number of words per sentence is called the "mean length of utterance" (MLU). The MLU equals the total number of words in a statement divided by the number of sentences: 

Total number of words / Total number of sentences = MLU

Most people tend to speak in sentences of between 10 and 15 words (ACFE Self-Study CPE Course, "Analyzing Written Statements for Deception and Fraud," 2009). When people feel anxious about an issue, they tend to speak in sentences that are either significantly longer or significantly shorter than the norm. Investigators should pay particular attention to sentences whose length differs significantly from the subject's MLU.


Complete and accurate descriptions of actual events are usually stated in the past tense and tend to have a predictable balance of prologue, critical event and aftermath. Truthful statements generally contain numerous self-referencing pronouns and include at least a few seemingly inconsequential details. Truthful statements rarely contain oaths, equivocation or euphemisms. Investigators should apply extra scrutiny to written or oral statements that deviate from these norms. Suspects and witnesses often reveal more than they intend through their choices of words.

Paul M. Clikeman, Ph.D., CFE, is an associate professor in the Robins School of Business at the University of Richmond. 


Antics with Semantics

It may happen that you inherit a case that someone else opened. Besides financial documents, all you have are the written statements from witnesses and suspects. Can you tell enough from words alone to detect evasion, lack of cooperation and the intent to deceive? Yes, you can.

Semantics is a discipline concerned with the meaning of words and the ways that words combine to form meanings in sentences. The noun "rock," for example, can indicate a stone or a type of music. As a verb, "to rock" indicates the action of causing something to rock (rock the cradle) or to rock oneself in a chair (rocking on the front porch) or a form of party-time behavior ("we were rocking last night").

Anytime you interpret someone's words — during a conversation, or as part of your professional duties — you are practicing semantics. Here is one example of semantic analysis:

Use of Present Tense when Describing a Past Occurrence

Sometimes deceptive individuals display a reluctance to refer to past events as past, particularly if the past event is the subject of investigation. They refer to past events as if they were occurring in the present. You should pay particular attention to those points in the narrative at which the speaker shifts to this inappropriate present tense usage, as in the following example.

How many times in this written statement does this person switch to the present tense? What seems significant about the points at which the switch occurs?

"On December 15, 2009, in the late afternoon hours, Don L. Harrington, wife Wanda, and friends Amy Barr, Judy Partin and Myself, Bob Boone, went to Taylor's to pick up some layaway items. We used two cars because there was some bulky merchandise such as bicycles and a battery-operated car. Don had just gotten his paycheck so instead of making a trip to the bank he would pay the balance of the layaway with his check. Wanda usually handles the finances, so she had Don's check in her purse. So Wanda hands Don his check, which in turn he gives it to the layaway clerk. The clerk look at the check and said that she couldn't accept it but it was obvious that clerk was inexperienced, because in fact it was the other clerk working in layaway that told the clerk that she would have to check with the manager first. So the clerk takes the check over to the manager, and we all see the manager shake her head ‘no.' By this time Don sees that he can't use his check, which was a surprise to us because it was a payroll check instead of a personal check. But instead of causing chaos, Don decided to pay for it in cash, which Wanda had in her purse. So Don asked her for the money, gave it to the clerk, the clerk gave him the receipt, and we went to the back to pick up the merchandise. In all the confusion, Don thought that Wanda had the check, and Wanda thought that Don had it, and by this time we had gotten to Don's house. So Don called ABC Company and told the payroll dept. that his check was lost."

Bob Boone uses the present tense in three sentences:

"So Wanda hands Don his check which in turn he gives it to the layaway clerk."

"So the clerk takes the check over to the manager, and we all see the manager shake her head ‘no.' "

"By this time Don sees that he can't use his check, which was a surprise to us because it was a payroll check instead of a personal check."

It is remarkable that the switch to the present tense occurs at key moments in the exchange: as the check is handed over, as the manager refuses to accept the check and as Don becomes aware he will not be able to use the payroll check. This indicates the person is sensitive about those moments.

Often, people use the present tense for past events when they are rehearsing the events in their mind. It is a device for keeping things straight. Maybe the person is just being careful, or maybe he is being deceptive.

As an investigator, you should note the switches to the present tense, and the point of the narrative at which these occur. From there, you will decide how to explore the issues further.

Excerpted and adapted from the ACFE Self-Study CPE Course, "Analyzing Written Statements for Deception and Fraud," 2009. This excerpt is by Don Rabon, CFE.

Further Reading



  • "Analyzing Written Statements for Deception and Fraud," ACFE Self-Study CPE Course, 2009 
  • "Investigating Discourse Analysis," by Don Rabon, CFE (Carolina Academic Press, 2003). 
  • "Identifying Lies in Disguise," by Wendell Rudacille (Kendall/Hunt, 1994). 
  • "I Know You Are Lying," by Mark McClish (The Marpa Group, 2001). 
  • "Statement Analysis: What Do Suspects' Words Really Reveal?" by Susan H. Adams, FBI Law Enforcement Journal (October 1996).  


Read more insight and discuss this article in the ACFE’s LinkedIn group.   


The Association of Certified Fraud Examiners assumes sole copyright of any article published on or ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to