CORCI logo
Focused certification exam prep
Start practice

What Is A CORCI?

TL;DR
  • CORCI means Certified Organized Retail Crime Investigator, issued by the McAfee Institute.
  • The standalone exam page lists a three-hour limit, online proctoring, one attempt and a one-year exam license.
  • Certification requires at least 70% on course sections and on the final online examination.
  • Professional eligibility paths combine education with one, three or five years of relevant investigative or intelligence experience.

The Plain Answer: What a CORCI Is

A CORCI is a Certified Organized Retail Crime Investigator: a person who has completed the McAfee Institute's training program and passed its proctored final examination in the investigation of organized retail crime (ORC). The same letters are also used as an abbreviation by other, unrelated credentials, so it is worth being precise. Everything in this article concerns the McAfee Institute's retail-crime investigator certification and nothing else.

Organized retail crime differs from ordinary shoplifting in its structure. Instead of one person lifting an item for personal use, ORC involves coordinated groups that steal merchandise at scale, move it through resale channels, and convert it to cash. Crews of "boosters" do the theft, "fences" buy and redistribute the goods, and online marketplaces and social platforms often supply the sales channel. The CORCI credential exists to certify that an investigator understands how those moving parts connect and how to build a case against them.

If you are comparing the many definitional pages on this topic, you may also want our related explainers on what CORCI is, what CORCI stands for and the meaning of the term. This article focuses on what the credential represents in practice and how its examination is set up.

Who Issues the Credential

The certifying authority is the McAfee Institute, which offers CORCI as part of its portfolio of investigator certifications. The training program is delivered through the institute's own platform, and the credential is earned by completing the coursework and passing the final online examination under proctored conditions.

This matters for candidates because the issuer, not a third-party testing company's generic blueprint, defines what counts. The program advertises 21 modules, but the public course page does not list every module title or lesson. Any study resource that claims to reproduce the full module-by-module syllabus without access to the enrolled course should be treated with caution. This site organizes preparation by editorial topic headings drawn from the official curriculum narrative, and those headings are not official module names or scored domains.

Why the distinction matters: The thirteen preparation areas used on this site are editorial categories built from topics the issuer explicitly names. They help you organize study time, but they are not an official exam blueprint, and no official domain weights have been verified. Treat them as a map, not a scoring guide.

What a CORCI-Level Investigator Actually Does

The job content behind the credential is a blend of traditional loss-prevention investigation and modern digital intelligence work. In practical terms, a candidate is expected to be comfortable moving between three environments.

The physical environment

Stores, parking lots, distribution points and the places where stolen goods change hands. Here the investigator thinks about surveillance, observation, documentation and the legal limits on how evidence is gathered. Understanding how booster crews operate on the floor, and how they are supported by drivers, spotters and handlers, is central.

The online environment

Auction sites, marketplaces and social-media accounts where stolen merchandise is advertised. The curriculum emphasizes collecting evidence from auctions and social media to identify perpetrators and the networks around them. This is open-source intelligence work: finding, preserving and attributing publicly available information in a way that holds up later.

The case environment

Turning scattered observations into something a prosecutor or partner agency can use. That means a clear chain of reasoning, properly handled evidence, and an understanding of how the retail victim, law enforcement and the courts each fit into the process.

The Thirteen Preparation Areas

Because the issuer does not publish a complete public syllabus, this site groups the explicitly named curriculum topics into thirteen editorial preparation areas. For a deeper walk-through of each, see our complete guide to all 13 content areas. Here is a compact overview of what each covers.

Organized-retail-crime structures

The foundation: how ORC groups are organized and why they matter commercially.

  • Fraud schemes and operational structures
  • Business impact on retailers
  • How roles divide between theft, transport and resale

Open-source intelligence (OSINT) and the intelligence cycle

Two linked areas covering how information is collected and how it becomes usable intelligence.

  • Gathering publicly available information methodically
  • Moving from raw collection to analysis and reporting
  • Keeping the process repeatable and defensible

Privacy

The boundaries that govern what an investigator may collect and how.

  • Respecting limits on information gathering
  • Understanding where compliance risk begins

Cyber investigations, auction fraud and social-media research

The digital core of the curriculum.

  • Collecting evidence from auctions and social platforms
  • Tracking and identifying criminal operations online
  • Building cases from social-media and OSINT material

Deception analysis

Recognizing misleading statements and behavior during investigative work, and understanding how deception shows up in schemes and communications.

Booster operations and fencing operations

The two ends of the stolen-goods pipeline.

  • Detecting booster tactics
  • Investigating fencing operations and how stolen goods are moved and resold

Surveillance, legal fundamentals and professional ORC case development

Where evidence-gathering meets compliance and presentation.

  • Surveillance that is effective and lawful
  • Legal fundamentals that keep evidence usable
  • Assembling a professional, defensible case file

The Six Published Learning Objectives

The issuer's public course page lists six learning objectives. These are the clearest official statement of what a graduate is expected to be able to do, so they deserve more attention than any third-party summary.

  1. ORC foundations: understanding fraud schemes, operational structures and business impact.
  2. Cyber investigation and evidence collection: using evidence from auctions and social media to identify perpetrators and networks.
  3. Auction and online-fraud investigation: tracking and identifying criminal operations.
  4. Social-media and OSINT investigation: gathering evidence and building cases.
  5. Booster and fencing operations: detecting and investigating their operational tactics.
  6. Legal fundamentals and surveillance: compliance and effective evidence gathering.
Read the verbs: Notice the action words in these objectives: identify, track, gather, build, detect, investigate. The credential is oriented toward applied investigative work, so expect scenario-style thinking rather than pure vocabulary recall. Preparing with that mindset will serve you better than memorizing definitions in isolation.

How the Examination Works

It helps to separate what is published from what is not, because many candidates mix the two up.

ItemWhat the current sources state
Time limitThree hours (standalone exam page)
DeliveryOnline, with proctoring
AttemptsOne attempt
Exam licenseOne year (a booking and access period)
Passing thresholdAt least 70% on course sections and on the final online examination
Question countNot verified from current sources
Official domain weightsNot verified
Observed pass rateNot published

Two cautions deserve emphasis. First, the program's 40 hours of instruction and 35 continuing-education credits describe the training, not the exam. They are not a timer and not a question count. Second, older brochures circulated online mention different question totals and a shorter time limit. Those figures are not part of the current specification, and you should not plan around them.

The 70% threshold is a minimum standard, not a statistic about how many people succeed. If you are curious about the distinction, our pieces on the passing score and pass rate explain what is and is not known. For a realistic read on difficulty, see how hard the exam is.

Key Takeaway

You get a single proctored attempt within a one-year exam license. Because there is no published retake structure to fall back on, finish the coursework fully and rehearse under timed conditions before you book. A practice bank on this site's practice test helps with rehearsal, but it supplements the official training rather than replacing it.

Eligibility, Cost and Access

Experience paths

The professional program lists three qualifying education-and-experience combinations, each tied to relevant investigative or intelligence work:

  • A bachelor's degree or higher, plus one year of experience
  • An associate degree, plus three years of experience
  • A high-school diploma or equivalent, plus five years of experience

Board certification also requires eligibility documentation, payment of all fees and adherence to the issuer's current conduct policy. Older brochure eligibility routes are not substituted for these current rules. For the full picture, read our guide to CORCI requirements.

What it costs

Two prices are currently published: the standalone exam offer at USD 450 and the full training bundle at USD 1397. Payment plans, optional study materials and tuition are not additional universal exam fees. The one-year exam license is an access window, not a renewal cycle, and current renewal requirements and fees were not verified. A fuller breakdown is in our certification cost guide.

OfferPublished priceWhat it represents
Standalone examUSD 450The proctored examination offer
Full training bundleUSD 1397Training plus the certification path

A|CORCI: The Associate Version

The issuer also offers an Associate Certified Organized Retail Crime Investigator designation, written A|CORCI. According to the current associate policy, it uses the same training curriculum and the same proctored certification examination. What distinguishes professional status is experience, not a different test. Moving from associate to professional does not require retraining or retesting.

For candidates still building the required experience, this is useful: you are not studying for a lighter or separate exam. Treat the associate and professional designations as one examination family. Preparing once covers both.

Who Hires People With This Credential

Organized retail crime investigators are typically found in a few overlapping settings. This is described qualitatively, because no verified hiring statistics are available.

  • Retail loss prevention and asset protection teams: large retailers with dedicated ORC units that build cases against theft rings.
  • Law enforcement and prosecutorial support roles: investigators who work alongside retailers on joint cases and case packages.
  • Investigative and intelligence consulting: private firms that support retailers and brands with online-marketplace monitoring and case development.
  • Marketplace and platform trust-and-safety functions: teams concerned with the resale of stolen goods online.

Be careful with claims that a certification guarantees a job, agency endorsement or individual acceptance by an employer. Catalog listings and institutional recognition do not equal guaranteed employment. The credential demonstrates tested knowledge and a completed program; employers still weigh your experience and judgment. If you are weighing the investment, see our analysis of whether the certification is worth it, the salary discussion and the overview of CORCI jobs.

Sequencing Your Preparation by Domain

Because the preparation areas build on each other, the order you study them matters more than any generic technique. A sensible sequence moves from structure to method to application. For a fuller plan, see our study guide; the outline below ties each stage to specific domains.

Week 1

Frame the problem

  • Organized-retail-crime structures: roles, schemes and business impact
  • Booster and fencing operations, so later digital material has context
Week 2

Learn the method

  • OSINT and the intelligence cycle
  • Privacy, so collection habits start out compliant
Week 3

Apply it online

  • Cyber investigations, auction fraud and social-media research
  • Deception analysis applied to listings and communications
Week 4

Close with law and case work

  • Surveillance and legal fundamentals
  • Professional ORC case development, then a timed three-hour rehearsal

The logic is simple: you cannot evaluate an online listing without understanding what a fencing channel looks like, and you cannot build a case without knowing the legal limits on the evidence you gathered. Leaving legal fundamentals and case development for the end lets you review them against everything else. Our one-page cheat sheet is a handy last-day refresher, and the main practice test lets you check recall across all thirteen areas.

Frequently Asked Questions

What does CORCI stand for?

In this context it stands for Certified Organized Retail Crime Investigator, a credential issued by the McAfee Institute. Other unrelated credentials use the same acronym, so always confirm the certifying body.

Is the CORCI exam the same as the training course?

No. The training program and the proctored final examination are separate components. The program describes 40 hours of instruction and 35 CPE credits, but those figures describe the training, not the exam's length or question count.

How long is the exam and how many attempts do I get?

The current standalone exam page publishes a three-hour time limit, online proctoring, one attempt and a one-year exam license. The current question count and scoring split are not verified.

What score do I need to pass?

The published policy requires at least 70% on course sections and on the final online examination. This is a passing threshold, not a measured pass rate, and no pass rate is currently published.

Do I need experience before I can be certified?

The professional program lists three paths: a bachelor's degree plus one year, an associate degree plus three years, or a high-school diploma or equivalent plus five years of relevant investigative or intelligence work. The associate designation, A|CORCI, uses the same exam with experience separating the statuses.

Ready to pass your CORCI exam?

Put this into practice with free CORCI questions across every exam domain.