Insurance Fraud Detection: Claims, Ghost Broking, SIU

Insurance fraud now arrives through the same digital channels insurers built for speed: online quotes, app-based claims, photo uploads and broker portals. The NAIC defines insurance fraud as a deliberate deception to obtain an illegitimate gain, and it can be committed by consumers, agents, adjusters, organised networks or people posing as insurers. This guide is for claims, underwriting, special investigation unit (SIU) and fraud analytics teams in general and motor insurance. It covers claims fraud, application and premium fraud, ghost broking, staged accidents and manipulated images, and how to build detection that holds up when a case reaches an investigator, a regulator or a court. It builds on the Fraud Prevention Guide for Digital Businesses and does not repeat its general fraud programme content.

Key takeaways

Detect at quote and onboarding, not only at claim. Application fraud and ghost broking are cheapest to stop before a policy is bound, and they seed many later claims problems.
Soft fraud is the volume problem, organised fraud is the value problem. Score every claim for exaggeration, but invest network analytics in rings, brokers and repeat parties.
Treat every uploaded image and document as untrusted input. Edited photos, reused images and AI-generated damage need provenance, duplicate and metadata checks before payment.
Link analysis beats single-claim rules. Shared phone numbers, devices, IP addresses, bank accounts, repairers and witnesses expose rings that look clean one claim at a time.
Build SIU referrals as evidence, not alerts. Regulators expect antifraud initiatives and reporting, and an investigator needs a reasoned referral, preserved originals and an audit trail.

Insurance fraud typologies by stage

NAIC separates hard fraud (deliberately causing or inventing a loss, such as destroying property to claim) from soft fraud (exaggerating a genuine claim or lying on an application for a lower premium), which it describes as a crime of opportunity and the more common of the two. The FBI adds intermediary and insider schemes: premium diversion, where an agent keeps premiums instead of passing them to the insurer, is the type it names as most common, alongside fee churning and asset diversion. Mapping each typology to the point in the policy lifecycle where it first becomes visible tells you where detection belongs.

Stage	Typology	Who commits it	First visible signal
Quote and application	Rating factor misrepresentation (address, no-claims history, driver, vehicle use)	Consumer, sometimes coached	Mismatch between declared data and third-party data, repeated quote manipulation
Quote and application	Ghost broking (fake, altered or cancelled policies)	Fake intermediary, organised network	Many policies sharing devices, IPs, emails or payment cards
Quote and application	Fronting (high-risk driver hidden behind a lower-risk main driver)	Consumer	Named driver age and vehicle profile, claims showing a different driver
In force	Premium diversion by an agent or broker	Intermediary or employee	Customers holding documents the insurer has no record of, payment reconciliation gaps
In force	Cancellation refund fraud	Ghost broker	Short time from inception to cancellation, refunds to accounts not matching the policyholder
Claim (first notification of loss)	Exaggerated or inflated claim	Consumer	Claim value against policy and loss profile, early claim after inception or cover increase
Claim	Staged or induced accident, phantom passengers	Organised ring, sometimes with complicit repairers or claims managers	Shared parties across claims, injury claims disproportionate to damage
Claim	Fabricated or manipulated evidence (photos, invoices, medical reports)	Consumer or ring	Duplicate image hashes, missing or inconsistent metadata, edited documents
Claim and recovery	Supplier inflation (repairs, hire cars, storage, medical treatment)	Third-party supplier	Outlier invoice values and durations by supplier

The lines NAIC lists as most affected by frequency and average cost are life, Medicare, property and casualty (including auto theft), health and workers' compensation. Health insurance fraud against members is covered separately in the Medical Identity Theft Guide.

Ghost broking and application fraud

Ghost brokers pose as insurance intermediaries, mostly for motor cover, and recruit buyers on social media, community groups and messaging apps. The UK Financial Ombudsman Service describes three models: no policy at all with fake documents; a genuine policy taken out on false details (a different address or driving history) to cut the price, which can be voided at claim; and a genuine policy that is bought, then cancelled soon after so the broker keeps the refund. The FCA warns that victims risk a seized vehicle, fines, a driving ban and personal liability after an accident. Trade press reporting of Insurance Fraud Bureau (IFB) figures in October 2026 put suspected organised ghost broking networks reported to the IFB at 596 in the previous 12 months, with fake policy documents often sent as photos or screenshots.

For the insurer, ghost broking looks like a cluster of individually plausible applications. Controls that work:

Device and network linking at quote: capture device identifiers, IP address, email domain and payment instrument at quote and bind. One broker setting up many policies from a single IP address was a factor the Ombudsman accepted when an insurer cancelled a ghost broked policy.
Payment instrument versus policyholder: a card or account in a different name paying for several unrelated policies is one of the strongest ghost broking indicators.
Data verification: validate address, driving licence and claims history against bureau and industry databases before bind, and flag repeated quotes on the same device with small rating changes (quote manipulation).
Inception to cancellation monitoring: report policies cancelled within days of inception, especially where refunds go to a third party.
Victim handling: the Ombudsman has found a fraud marker unfair where a consumer bought innocently through a ghost broker and was not given the option to cancel. Separate the victim from the broker in your case outcome.

Consumer-facing checks (FCA Firm Checker, the Motor Insurance Database, an official website and landline, no payment by bank transfer to an individual or crypto) belong on quote journeys and social media warnings. Application fraud that relies on stolen or invented identities is covered in the Synthetic Identity Fraud Guide and the Identity Fraud Prevention Guide.

Claims fraud: staged accidents and inflated claims

Staged motor accidents ("crash for cash" in the UK) are usually organised. A typical pattern has a vehicle brake suddenly in front of an innocent driver so it is hit from behind, then multiple occupants claim whiplash and the claim is routed through a chosen claims manager, repairer, hire company and clinic. Phantom passengers and fully paper accidents, where no collision happened, follow the same economics. Each claim on its own can look normal; the ring only appears when parties are linked.

Red flags at first notification of loss

Timing: claim shortly after inception, cover increase, added driver or vehicle change.
Parties: occupants, witnesses, phone numbers or addresses shared with earlier claims, or a third party whose representative contacts the insurer before the policyholder does.
Injury to damage ratio: several injury claims from a low speed rear-end impact, or occupants who were not mentioned at the scene.
Supplier routing: the same accident management firm, repairer, storage yard or clinic recurring across unrelated claims.
Narrative: location or time that does not match telematics, weather or roadside data where available.

Inflated and opportunistic claims

Soft fraud is better handled with scoring and proportionate friction than with investigation. Add questions or a video assessment when a contents claim jumps after a cover change, ask for proof of purchase above a threshold, and compare item values against retailer data. Keep the friction proportionate: most claimants are genuine, and heavy handed treatment drives complaints.

Manipulated images and documents

Photo-first claims journeys made digital evidence the main input to settlement, and that evidence is now easy to edit, reuse or generate. The same IFB reporting notes that fake policy documents are stolen, doctored or photoshopped. Treat each upload as untrusted and run layered checks before payment, not after.

Check	What it catches	Limits
Perceptual and exact hashing against your own claims archive	The same damage photo reused across claims or claimants	Needs a searchable store of past claim media
Reverse image search against the web	Stock or social media images presented as the claimant's own	Misses private or newly generated images
Metadata review (capture time, device model, GPS, software tag)	Photos older than the loss date, taken elsewhere, or passed through editing software	Metadata is easily stripped or forged, so absence is weak evidence
Content Credentials (C2PA) verification	Signed provenance showing the capture device, edits and AI generation recorded by credential-aware tools	Credentials can be stripped and absence proves nothing; a valid credential shows integrity, not truth
In-app live capture	Uploading pre-existing or edited files, since the app captures directly with time and location	Determined fraudsters photograph a screen, so pair with liveness style checks
Document forensics on invoices, estimates and medical reports	Edited amounts, fonts, templates or supplier details	Confirm with the issuing supplier for high value items
Image forensics and AI-generated content classifiers	Splicing, cloning and synthetic damage	Classifiers produce false positives and lag new generators; use as a referral signal only

The C2PA explainer is explicit that Content Credentials are tamper evident records of an asset's history and that a missing credential does not mean an asset is fake. Use provenance as a positive signal when present, never as a reason on its own to decline. For detection tooling choices see the Deepfake Detection Buyer's Guide.

SIU analytics and detection architecture

Effective insurance fraud detection combines four layers, each feeding the SIU with fewer, better referrals.

Business rules: transparent, auditable red flags (claim within 30 days of inception, payee mismatch, known bad repairer). Easy to explain to regulators and claimants, easy for fraudsters to learn.
Predictive scoring: supervised models trained on confirmed fraud outcomes, applied at quote, bind and FNOL. Their quality depends on SIU outcomes being recorded consistently as labels.
Anomaly detection: unsupervised outlier detection for new patterns, such as supplier invoices or claim values far from peers.
Network (link) analysis: an entity graph of people, vehicles, addresses, phones, devices, bank accounts, IPs, suppliers and claims. Rings appear as dense clusters and repeated shared attributes.

Industry data sharing multiplies all four layers: shared claims and fraud databases expose people who claim with several insurers. The principles are in the Fraud Data Sharing and Consortium Intelligence Guide.

Choosing where to invest

Situation	Start with	Add next
Small or regional insurer, low claim volume	Rules plus consortium data plus a small SIU	Vendor scoring with explainable reasons
Large motor book with organised crash for cash exposure	Entity resolution and network analytics	Supplier analytics and telematics corroboration
Digital direct writer with fast quote and bind	Device, IP and payment linking at quote	Quote manipulation detection and inception to cancellation monitoring
Photo or app-first claims	Image hashing, metadata and live capture	Provenance verification and forensic review on referral
Broker or delegated authority distribution	Premium reconciliation and intermediary monitoring	Per-broker loss ratio and cancellation analytics

Regulatory duties that shape the SIU

In the United States insurance is state regulated. The NAIC Insurance Fraud Prevention Model Act asks insurers to have antifraud initiatives reasonably calculated to detect, prosecute and prevent fraudulent insurance acts, through fraud investigators or an antifraud plan filed with the commissioner (Section 11); requires persons in the business of insurance to report suspected fraud (Section 6); gives immunity for reporting in good faith (Section 7); and requires a fraud warning statement on claim forms and applications (Section 4). Each state enacts its own version, so confirm the rules in each state you write. NAIC reports that 42 states and the District of Columbia run insurance fraud bureaus. In the UK, ghost broking victims are directed to Report Fraud, the FCA and the IFB Cheatline, and complaints about insurer handling go to the Financial Ombudsman Service. For the wider sector programme see the Insurance Sector Cybersecurity Programme Guide and the NAIC Insurance Data Security Model Law Guide.

Implementing an insurance fraud detection programme

Inventory channels and data: list every quote, bind, mid-term change, claim and payment channel, including brokers and aggregators, and what data each captures (device, IP, images, payee).
Fix the outcome labels: agree fraud outcome codes (confirmed, withdrawn, repudiated, inconclusive, genuine) and make the SIU record them on every referral. Without labels, models cannot learn and metrics are meaningless.
Build entity resolution: match people, addresses, vehicles, phones and accounts across policies and claims before building scores.
Run new rules and models silently: score in shadow mode for one or two quarters, compare against SIU outcomes and tune thresholds before they affect customers.
Pilot friction, not declines: route high scores to extra evidence requests or a call, not to automatic refusal, and measure complaint and conversion impact.
Design the referral pack: each referral lists the triggering rules, score reasons, linked entities and preserved originals (images with metadata, call recordings, device data).
Roll back safely: keep rules versioned with an owner, and switch a rule or model back to shadow mode if false positives or complaints rise.
Close the loop: feed outcomes, Ombudsman decisions and reports to fraud bureaus back into rules and models.

Where identity fits

Insurance fraud increasingly runs through accounts: claimant portals, broker logins and adjuster tools. A stolen broker or adjuster credential lets a fraudster quote, bind, cancel or download claim files at scale. In the Scania insurance portal breach, an attacker logged into a partner-run claims application with a legitimate external user's credentials, believed stolen by infostealer malware, and downloaded claim documents, which is exactly the material needed to build convincing false claims. Require MFA for brokers, partners and claims staff, monitor bulk downloads (ATT&CK T1078 Valid Accounts is the relevant technique), and govern API keys used by aggregators and claims suppliers as non-human identities. See the Insurance Sector Identity Security Guide and the Account Takeover Prevention Guide.

Detection and measurement

Log: quote and bind events with device and IP, mid-term changes, cancellations and refunds, FNOL data, every uploaded file with hash and metadata, payee changes and portal logins.
Referral hit rate: share of SIU referrals that end in a confirmed fraud outcome. A falling rate means rules are noisy.
Detected fraud value and savings: confirmed fraudulent claim value avoided or recovered, by line and channel.
False positive friction: share of genuine customers who received extra checks, and their complaint rate.
Time to referral: days from FNOL or bind to SIU referral. Earlier referral means less paid out.
Ring coverage: share of confirmed organised cases first detected by network analytics rather than by an adjuster.

The Fraud Metrics and KPIs Guide covers how to define and report these consistently.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev 5	Other
Record fraud typologies and threats by channel	ID.RA-03		NAIC Model Act Section 11 antifraud initiatives
Identity proofing at quote and onboarding	PR.AA-02	IA-2 (staff and broker users)
Broker, partner and adjuster account governance	PR.AA-01	AC-2	ATT&CK T1078
Scoring and anomaly analysis of claims	DE.AE-02	SI-4
Link analysis across policies, claims and consortium data	DE.AE-03
Supplier and intermediary oversight	GV.SC-07	SR-6
Fraud reporting with bureaus and law enforcement	RS.MA-01		NAIC Model Act Sections 6 and 7

Common failure patterns

Looking at claims one at a time: staged accident rings and ghost broking networks are invisible without entity resolution across policies, claims and suppliers.
Accepting images as evidence: paying on uploaded photos with no duplicate, metadata or provenance check invites reused and edited images, and soon synthetic ones.
Punishing victims of ghost brokers: voiding and fraud marking innocent buyers creates Ombudsman losses and misses the broker who should be the target.
No outcome labels: SIU closes cases without consistent codes, so models train on noise and nobody can say whether detection works.
Weak partner and broker access: password-only logins to claims portals, as in the Scania incident, expose claim documents and let insiders or attackers bind and cancel at scale.
Classifier overconfidence: declining on an AI-image detector score alone leads to wrongful declines and poor defensibility.

Practitioner checklist

Map every typology in your book to the stage where it first becomes visible, and put a control there.
Capture device, IP, email and payment instrument at quote and bind, and link them across policies.
Monitor policies cancelled soon after inception and refunds to third parties.
Hash and store every claim image, check for duplicates and review metadata before payment.
Verify Content Credentials where present, and never decline on their absence alone.
Build an entity graph across claims, parties, suppliers and consortium data for ring detection.
Run new rules and models in shadow mode and pilot friction before any automatic decline.
Standardise SIU outcome codes and referral packs with preserved originals.
Enforce MFA and download monitoring for broker, partner and adjuster accounts.
Confirm state reporting duties and fraud warning wording for every jurisdiction you write.

Insurance Fraud Detection Guide: Spotting Claims, Application and Digital Fraud