How Can Insurers Detect Fraud Rings Before Paying Claims?

Insurers detect fraud rings before payment by running link analysis on every claim at first notice of loss (FNOL), checking each claim's bank account, phone number, device, address and repair shop against the whole book of business. Rings are built from claims that pass individual checks, so a ring check that waits for an SIU referral usually finds them after the claim is paid.

On a Monday morning at a mid-sized US property and casualty carrier, a claims adjuster opens the first file in her queue. It's a large property claim, reported some weeks after the loss. She works through it the way she's worked through thousands. The policy is in force. The photos match the description. The estimate fits inside the range she'd expect for a loss like this.

A few details catch her eye:

Each detail has an ordinary explanation. The claims adjuster sees many of these examples in a given week and all seems to be on par. None of them, on its own, is reason to refer the claim to the Special Investigations Unit (SIU).

So, the claim moves toward payment. And by every check the carrier runs, it should. And the carrier in this example uses AI to fight fraud. It has a rules engine, a predictive fraud model, text mining of the claim notes, and a tool that analyzes photos. Every one of them looked at this claim. But none of them found anything unusual.

What they couldn’t see was the bank account. That account, and the phone number next to it, also sat on claims from  claimants already flagged in earlier SIU referrals. The claim on her desk was one piece of a bigger puzzle, and the only place you could see that was in the links between claims.

In this case, the claim didn't get paid. We'll come back to why. But in most claims operations, it would have been, and that's how fraud rings get paid every day.

What is a fraud ring?

A fraud ring is an organized group of people who work together to file many fraudulent insurance claims, spread across different policies, claimants and sometimes different insurers, so that each claim looks legitimate on its own. Investigators also call it organized insurance fraud or collusion, and in auto claims, a staged-accident ring.

A typical auto ring has organizers, recruited drivers and passengers, and cooperative body shops, clinics or attorneys.

The giveaway is what they share behind the scenes: the bank accounts the money lands in, the phones, the addresses and the repair shops.

The problem: every claim cleared.

Fraud rings are built to pass. The people who organize staged accidents know roughly what a rules engine flags. They build each claim to stay below the radar including minimal injuries, losses spread across different policies and different months, and drivers with clean records and no history worth checking.

Judged one at a time, every claim looks to be in line. And almost every fraud tool judges claims one at a time. The rules engine tests this claim against thresholds. The model scores this claim against past patterns. Text mining reads this claim's notes, and  image forensics looks at this claim's pictures. Four tools, four opinions, each about one slice of one claim.

It's a bit like a border officer checking passports. Every passport is genuine, and every photo matches the face of the person in front of her. She'd only spot the problem if she noticed that 40 travelers that week gave the same return address, and her desk isn't set up to notice that.

In the auto industry, the problem is growing. Staged accidents cost the insurance system roughly $20 billion annually in the United States alone, says the FBI. A staged accident is almost never a solo act. It needs drivers, passengers and a co-operative body shop, and sometimes a clinic as well. That's a network. And networks leave links.

There's enough money in it to run as a business. The Coalition Against Insurance Fraud put the cost of US insurance fraud at $308.6 billion a year, causing each policyholder to pay $900 more through annual premium increases. Organized groups go where the volume is, and auto claims have volume.

Your ring check runs after you have already paid.

Most carriers already own link analysis. The trouble is where it sits in the process.

In a typical claims operation, the network check comes last. A claim gets flagged, an adjuster refers it, SIU accepts the referral and an investigator pulls the file. Only then does somebody map who the claimant is connected to.

Every step in that chain starts with suspicion. So, link analysis only ever sees the claims someone already doubted, which means it never sees the clean-looking claims a ring is made of. The claim on that adjuster's desk on Monday morning would never have reached it.

Then there's time. Each handoff takes days. By the time an investigator draws the map, the claim has often been paid, and  fraud prevention has turned into pay-and-chase.

It's easy to see how carriers ended up here. Mapping connections used to mean an investigator, a spreadsheet and a free afternoon, and SIU never has many free afternoons. So, the work got rationed to the claims that looked worst. That made sense when the map had to be drawn by hand. Software can now draw it in seconds, for every claim, and most carriers still ration it.

What data links expose a fraud ring?

A ring can recruit new drivers, buy new policies and stage a new accident every month. What it struggles to change is its plumbing. Somebody has to receive the money, answer the phone and fix the car, and it tends to be the same few people every time.

That plumbing shows up in five places:

None of these proves fraud by itself. Families share addresses. Good body shops have regular customers. What matters is the pattern: how many claims connect, how quickly, and whether the people involved have any reason to know each other.
Put those links on a map and you get a network graph, a picture of which claimants, accounts, phones and repairers connect to each other. A ring shows up on it the way a highway interchange shows up on a road map.
 The pattern often crosses carriers. In North Carolina in 2006, one insurer noticed unusual claim activity tied to the same vehicles and the same addresses. Investigators went on to charge 10 people over more than 480 auto claims worth about $1 million. At least 8 insurers had paid out, and each one had been looking at its own slice.

Here’s how the two approaches compare:

What data links expose a fraud ring?