UNMASKING FRAUD : RULES FOR IDENTIFYING COVERT ROLES