CORCI Study Guide 2026: How to Pass on Your First Attempt

What You Are Actually Preparing For

The Certified Organized Retail Crime Investigator credential, issued by McAfee Institute, tests whether you can think and work like an investigator who builds cases against organized theft networks rather than one-off shoplifters. That distinction shapes everything about how you should study. A candidate who only knows loss-prevention basics will struggle; a candidate who can connect a stolen-goods listing to a fencing pipeline, document the evidence properly and stay inside legal limits will be well positioned.

If you are still orienting yourself, the explainers on what CORCI certification is and what CORCI stands for cover the basics. This guide assumes you have decided to sit the exam and want a plan that respects what is actually known about it.

The Six Published Learning Objectives

The official program page describes six learning objectives. Treat these as the closest thing to a public statement of scope, and read each one literally:

• ORC foundations: fraud schemes, operational structures and business impact.
• Cyber investigation and evidence collection: evidence from auctions and social media used to identify perpetrators and networks.
• Auction and online-fraud investigation: tracking and identifying criminal operations.
• Social-media and OSINT investigation: gathering evidence and building cases.
• Booster and fencing operations: detecting and investigating their operational tactics.
• Legal fundamentals and surveillance: compliance and effective evidence gathering.

Notice the verbs: identify, track, gather, build, detect, comply. The material is applied. Expect to be asked what an investigator would do or recognize, not merely to define vocabulary.

Exam Mechanics: What Is and Is Not Confirmed

Good preparation starts with knowing which facts are solid. The current standalone CORCI examination page publishes a three-hour time limit, online proctoring, one attempt and a one-year examination license. The certification policy requires at least 70% on course sections and on the final online examination, along with eligibility documentation and payment of all fees.

Several details are not publicly confirmed, and you should be skeptical of any source that states them confidently:

• The current number of questions and the scored/unscored split.
• The exact live item format.
• Official topic weights.
• Any pass rate.

Older brochures circulated figures such as a different total question count and a shorter time limit. Do not carry those forward; the current standalone page is the reference for timing. For a deeper look at the threshold itself, see the CORCI passing score breakdown, and for what the data does and does not show about outcomes, read the CORCI pass rate analysis.

The Thirteen-Topic Study Map

The site organizes preparation into thirteen headings drawn from topics named in the official curriculum narrative. These are editorial preparation categories: they are not official module titles, not scored domains and not a confirmed exam blueprint. The issuer advertises 21 modules but does not publicly list all their titles or contents, so this map should be treated as a way to organize study, not a claim about how the exam is carved up. The full list is in the CORCI exam domains guide.

1. Organized-retail-crime structures
2. Open-source intelligence (OSINT)
3. The intelligence cycle
4. Privacy
5. Cyber investigations
6. Auction fraud
7. Social-media research
8. Deception analysis
9. Booster operations
10. Fencing operations
11. Surveillance
12. Legal fundamentals
13. Professional ORC case development

Because weights are unverified, the safest assumption is that any of these can appear. The sections below group them into clusters that tend to reinforce each other when studied together.

Investigative Core: Structures, Boosters and Fencing

Study these three together. A question about a booster's behavior may only make sense if you understand where the goods go next, which is why the fencing material belongs in the same study session. If you are curious about the roles this knowledge leads to, the CORCI jobs overview describes where these skills are applied.

Digital Evidence: OSINT, Auctions and Social Media

Four of the thirteen topics, along with two of the six published learning objectives, sit in the digital space. This is a large share of the curriculum narrative, so give it proportionate attention.

OSINT and the Intelligence Cycle

Open-source intelligence means gathering information from publicly available sources. The intelligence cycle is the disciplined process wrapped around it: defining what you need to know, collecting, processing, analyzing and reporting. Candidates sometimes treat OSINT as a bag of search techniques. The exam-relevant skill is understanding it as a structured workflow where collection serves a defined question and analysis turns raw data into something a prosecutor or manager can use.

Cyber Investigations, Auction Fraud and Social-Media Research

The cyber investigation objective centers on evidence from auctions and social media used to identify perpetrators and networks. The auction objective is about tracking and identifying criminal operations. The social-media objective is about gathering evidence and building cases.

• Auction fraud: how stolen merchandise is listed and sold, how seller behavior and listing patterns point to a source, and how to preserve listing evidence before it disappears.
• Social-media research: connecting accounts, associates and activity to individuals and groups while documenting what you find in a way that can support a case.
• Cyber investigations: the broader practice of tying digital footprints to real people and organizations.

Legal Fundamentals, Privacy and Surveillance

This cluster is where candidates with strong investigative instincts can still lose points. The published objective pairs legal fundamentals and surveillance with compliance and effective evidence gathering, and the thirteen-topic map adds privacy as its own heading.

Jurisdiction-specific legal detail is not something this guide can supply, since the public sources do not expose the complete curriculum. Rely on your official training materials for the specific legal content and use this section to know which themes to expect.

Case Development and Deception Analysis

The final two topics tie everything together.

When you review earlier topics, keep asking how each one would feed a finished case file. That habit turns isolated facts into the integrated judgment the credential is designed to reflect. A one-page refresher of high-yield facts is available in the CORCI cheat sheet.

Sequencing Your Preparation

Because the training is 40 hours and the topics build on one another, order matters more than raw hours. The timeline below is a suggested sequence, not an official schedule. Adjust the length to your experience; an investigator with years of retail-theft work can compress the early weeks, while someone new to digital investigation should expand weeks three and four.

A practice question bank is useful editorial preparation, but it does not replace the official training, identity checks, eligibility review, proctoring or the issuer's own assessment. Use practice questions to find gaps, then return to the course material to close them. Candidates wondering how demanding all this is can compare notes in the difficulty guide.

Eligibility, Fees and Access Window

Certification involves more than passing. The published policy requires at least 70% on course sections and the final examination, eligibility documentation and payment of all fees. The current professional program lists qualifying paths of a bachelor's degree or higher plus one year, an associate degree plus three years, or a high-school diploma or equivalent plus five years in relevant investigative or intelligence work. Apply the current published conduct and eligibility policy rather than any older brochure route. The full picture is in the CORCI requirements guide.

Optional payment plans, study materials and tuition are not additional universal exam fees. The one-year exam license is a booking and access period, not a verified certification-renewal cycle; current renewal requirements and fees were not verified from the reviewed sources, so confirm them directly with the issuer. For a fuller look at the numbers, see the CORCI certification cost breakdown, and for timing questions, the CORCI exam dates guide.

Weighing the Investment

Whether the credential justifies the cost depends on your role and goals. Hiring outcomes and earnings vary by employer and are never guaranteed by a certification alone; agency catalog listings or institutional recognition should not be read as individual credential acceptance or guaranteed employment. For a structured way to think it through, see the ROI analysis and the salary guide.

Frequently Asked Questions

A strong first-attempt result comes from matching your preparation to what is genuinely known: a three-hour proctored exam, a 70% threshold and thirteen interlocking topics spanning network structures, digital evidence, legal limits and case building. Work through them in sequence, practice at full length, and let the official training remain your authoritative source.