Guidewire ClaimCenter fraud: the investigation is filed there, not run there

Guidewire ClaimCenter is where an insurance fraud investigation gets filed, tracked, escalated, and closed. It is not where one gets performed, and Guidewire has never said it was. Guidewire's own ClaimCenter product page describes the system as providing "industry-leading functional depth that enables you to govern the entire claims lifecycle," from claim intake to closure, across 270+ customers in more than 30 countries. Governing a lifecycle and executing an investigation inside one are different jobs.

That distinction carries the whole post. ClaimCenter holds a genuine native special-investigations capability: referral routing, accept and reject dispositions with structured reasons, workplan activities, supervisor escalation on a timer, and an outcome record with roughly fifteen fields on it. Every one of those objects is a container. Someone still has to fill them, and filling them is the part that takes 14+ days.

What follows is a Guidewire-specific teardown: what ClaimCenter natively holds for SIU according to a live carrier implementation published in public, where Guidewire's own analytics pages draw their line, which fraud vendors score into the claim file through the Marketplace, what the Marketplace offers when you ask who actually runs the investigation, and what the Qusar release of August 2026 changed. If you are still shortlisting a core claims system rather than working inside one, start with our comparison of Guidewire, Duck Creek, Majesco and Snapsheet and come back here afterward.

One frame to set before the evidence. Nothing below argues that ClaimCenter should ship a fraud investigation engine, or that any carrier should replace it. A claims system of record has a scope, Guidewire executes that scope at the scale of 270+ carriers, and the gap described here sits outside that scope by design. The question is not whether Guidewire covered it. The question is who does.

ClaimCenter's native SIU capability is a case-management workflow. It routes a referral, records an accept or reject decision with a structured reason, tracks activities against a workplan, escalates on a timer, and stores the outcome in a dedicated screen. It is real, and it is more detailed than most vendor comparisons give it credit for. Guidewire's product documentation sits behind a customer login, so the available public evidence of what a configured ClaimCenter SIU module looks like comes from a carrier's own training material.

Citizens Property Insurance Corporation, the Florida residual-market carrier, publishes a "Special Investigations Unit (SIU) Reference Manual" for its ClaimCenter users. The document is footer-dated 04/13/2018, walks the SIU workflow screen by screen with screenshots, and is hosted on the Citizens training site. Public descriptions of ClaimCenter SIU mechanics at that level of detail are rare, and this is one.

In that implementation, the claim's left sidebar carries three SIU entries: SIU Status, SIU Accept/Reject, and Special Investigation. A referral into the SIU resolves to one of three dispositions, SIU Accept, SIU Reject, or SIU Referred. A rejection carries a reason drawn from a fixed list: No Indicator, No Exposure, Investigation Incomplete, or Other.

Sit with the third item on that list. A referral can leave the SIU queue with a rejection reason of Investigation Incomplete, which per the manual sends it back to the adjuster. The data model anticipates that some referrals will exit the SIU without the work having been finished, which is an honest piece of schema design and a useful field for any carrier measuring its own coverage gap.

Work against an accepted referral is tracked as activities on the claim workplan. The manual names four: Management Review, SIU Acceptance, SIU Activity, and User Initiated SIU Referral. Each activity carries an escalation date, described in the manual as follows: "The Escalation Date provides a period of time to complete the activity before it is escalated to your supervisor's activities queue."

That sentence is worth reading twice. What escalates is the timer, not the work. When the clock runs out, the activity appears in a supervisor's queue, where a second human now has the same task and the same tooling as the first. Escalation redistributes attention. It does not add capacity.

ClaimCenter does natively order one class of evidence. The manual explains that during an investigation you may need to request a police or fire report, and that "In ClaimCenter, this is referred to as a 'metropolitan' or 'metro report.'" That is a real integration doing real work, and it covers one document type out of the dozen an SIU file typically needs.

Closing carries the same shape. The manual instructs that closing the SIU investigation "should be done only when there are no outstanding leads to pursue." That is a judgment call, made by a person, recorded in a field.

The SIU Details screen is an outcome record

The SIU Details screen documented in the manual holds two groups of fields. Claim Outcome carries SIU Completion Date, Claim Disposition Date, Disposition, an examination-under-oath indicator, Reserve/Exposure, Total Indemnity Payment, Allocated Expenses, and LMM. Fraud Bureau and Enforcement carries a DIF referral indicator, Date of DIF Referral, Date of Suspicion, DIF Office, DIF Tip Number, DIF Case Number, and an NICB indicator. The DIF fields are Florida-specific configuration.

Every one of those fields is answerable only after the investigation has already happened. A completion date requires a completed investigation. A disposition requires a decision. A total indemnity payment requires a settled claim. A fraud bureau case number requires a referral someone already made. There is not a field on that screen that a system could populate by investigating something.

The manual states plainly who does populate them.

The same pattern shows up upstream of the referral. Before an adjuster refers a claim to the SIU, the manual instructs them to "Update claim file with a status report outlining SIU issues" and to "Upload all documents to the claim file, including interviews and statement summaries." Both are manual work. ClaimCenter provides the place they land and the routing that moves them, which is exactly what a claims system of record is supposed to provide.

Guidewire's analytics products are precise about their own scope, and fraud investigation sits outside it. The Guidewire Predict page describes the product as embedding "insights into underwriting and claims processes with predictive analytics specifically made for P&C insurance," supporting "smarter decisions on risk selection, pricing, claims triage, settlement, litigation detection, and much more."

The full list of named use cases on that page runs to risk selection, pricing, claims triage, settlement, litigation detection, claim outcome improvement, adjuster workload optimization, reserve setting, inspection level determination, third-party report cost and benefit, straight-through processing, churn, and cross-sell. Fraud is not among them. Neither is SIU, and neither is subrogation. Predict is a P&C machine-learning platform, so a carrier with in-house data science could operationalize a fraud propensity model on it. That is a build, not a shipped product.

Guidewire Explore draws its line in the same place. It is described as "Guidewire's insurance business intelligence software," empowering "strategic business decisions through comprehensive financial and operational intelligence across policy, billing, and claims," across premium analysis, loss analysis, working capital and cash flow, underwriting workflow, claims workflow, and claims inventory. Fraud, SIU and investigation appear nowhere on it either.

Guidewire's own explainer on predictive analytics in insurance states the boundary in one sentence: predictive models "assign risk scores to incoming claims, allowing insurers to automate processing or flag potentially fraudulent claims for further review."

That is an accurate description of what a predictive model does, not a hedge. A score is a prioritization instrument. It tells you which claims deserve attention and it stops there, because the next step requires going out and getting evidence that does not exist in the claim file yet. Everything in this post lives on the far side of the phrase "for further review." Detection is upstream; investigation is downstream.

The fraud signal inside a ClaimCenter stack comes from partners, arrives through a published validation program, and lands in the claim file as a score with reason codes. That is a well-built ecosystem answer to the detection problem, and it is worth knowing precisely who is in it.

Treat that as a verified sample as of September 2026, not a census. The Marketplace catalog changes continuously and Guidewire does not publish a browsable fraud taxonomy at a public URL. Note also that the terms differ by listing: Guidewire's releases use "Accelerator," "Add-on," and "Marketplace app," and there is no publicly documented ranking among them.

FRISS is the only vendor in that table with two fraud listings, six years apart. Guidewire's April 2020 announcement describes the add-on as helping insurers "automatically check claims for potential fraud and risks at multiple stages of the claim workflow in Guidewire ClaimCenter," having "successfully completed the Ready for Guidewire validation process." Becky Mattick, then Vice President of Solution Alliances at Guidewire, framed the demand side: "Demand for anti-fraud insurance solutions is high, and process automation for fraud identification and management is an important element for insurers." The current FRISS Accelerator for Claims Analytics listing, version 1.0.0 released 3 June 2026 for Palisades, describes real-time fraud detection using AI techniques, network analytics and fraud indicators "to highlight suspicious claims from FNOL to payout."

The integration mechanics have been public for years. A September 2018 Guidewire blog post by Laura Drabik describes them concretely: the FRISS score displays within the claim file with details about indicator hits, activities can be generated from the results, and payments and reserves can be blocked. That post is eight years old and both products have moved on, but the shape it describes holds: a score, an indicator list, and a workflow trigger, landing on a claim someone then has to work.

Shift Technology brought its Claim Fraud Accelerator to the Marketplace in October 2022, delivering fraud alerts from Shift Claims Fraud Detection into the Guidewire Cloud claims environment, with Shift claiming it could potentially reduce implementation time by 50 percent. Shift's current Guidewire page describes claims professionals reviewing "fraud scores, reason codes, and suspicious activities within ClaimCenter on the Shift Claims Fraud Detection tab," and says the accelerator "speeds up settlement for genuine claims and redirects suspicious claims to the SIU." Shift also claims the combination lets an SIU identify fraud with a 3x hit rate. Both the 50 percent and the 3x are vendor figures, presented here as vendor claims.

That last clause states the handoff precisely: the accelerator redirects suspicious claims to the SIU. That is where a detection product's job correctly ends. Verisk's ISO ClaimSearch Accelerator, announced May 2019, ends in the same place with a different input: Carlos Martins, VP and GM of ISO Claims Solutions at Verisk, described it as letting ClaimCenter v9 customers "quickly access the claims intelligence and fraud detection capabilities of ISO ClaimSearch." Quantexa's accelerator, globally available in January 2026, adds a connected view of customers, claimants and suppliers. Richer signal, same terminus.

The scoring layer has been solved several times over, and solved well. The problem it creates is arithmetic. Rules-based and hybrid scoring runs a 60-85% false-positive rate against Hesper's internal benchmarks, which means the referral queue is always larger than the SIU that receives it. For a full map of who does the scoring and how the approaches differ, see our rundown of the top insurance fraud detection platforms in 2026.

Ask the Guidewire Marketplace who runs the investigation on an accepted SIU referral and two answers come back. Both are honest, both are useful, and neither is software doing the investigation.

The first answer is a human made slightly faster. Skopenow Pre-Check, announced January 2023, analyzes social media, dark web and court records and returns a Digital Score from 1 to 100 with a recommendation. Zachary Gustafson, General Manager of Claims and InsuranceNow at Guidewire, described the value directly: "Pre-Check can save investigators time by giving them clear, actionable, and data-driven recommendations on which subjects have a digital footprint worth investigating."

That is a triage instrument for the triage instrument. It runs one class of open-source check and tells a human whether the next step is worth taking. The same release carries a statement of the underlying problem from someone with no product to sell.

The second answer is a different human, outsourced. VRC Investigations became a Ready for Guidewire validated add-on in April 2021, letting ClaimCenter users "easily make investigative referrals directly within ClaimCenter," save time through automatically pre-filled claim data, and receive status updates, service documents and reports from VRC back inside Guidewire. It is a well-built integration. What flows through it is a referral out and a report back, with field investigators doing the work in between.

Guidewire named the capacity problem itself in that release.

Neither of those is a criticism of either vendor. Skopenow automates an OSINT lookup well and VRC runs field investigations at scale, and both are the correct products for what they set out to do. The observation is about the shape of the set: across the fraud and SIU listings on the Marketplace, every one either produces a signal for a human to act on or routes the file to a human elsewhere. There is no listing whose output is a completed investigation.

The bottom four rows are what the 14+ day manual investigation actually consists of, and they are the rows with no vendor in either column. That is why a manual SIU investigation takes 14+ days per case, why an investigator carries 200+ open cases while completing roughly 10 investigations a month, and why roughly 25% of flagged claims get a full investigation while the rest are paid, denied without full work, or queued indefinitely. Those are Hesper's internal benchmarks, and the structural reasons behind them are laid out in our 2026 SIU technology stack breakdown.

On 3 August 2026, Guidewire announced its Qusar release, introducing an Agentic Framework that lets insurers "build, deploy, and manage AI agents on Guidewire Cloud Platform." Agents built on it get "secure, real-time access to policy, claims, and billing data and workflows," with the stated goal that "decisions that once took days can happen in minutes."

The Guidewire-built claims agents named in the release are Claim Summarization for ProNavigator and an agentic FNOL that uses conversational voice AI for loss reporting. The release also states that its Developer Assistants ship features more than 40% faster than generic coding assistants, which is Guidewire's own figure.

No fraud agent and no SIU agent is named in the release, and Guidewire did not claim one. Summarization and intake are sensible first-party agents to build: high-frequency, low-variance, and sitting on data the platform already owns. An investigation agent is none of those things, because most of the evidence it needs is outside the claim file and outside the core system entirely.

The more interesting read for an SIU is what the framework enables rather than what it omits. Guidewire built the road. Secure, governed, real-time agent access to the claim record is exactly the substrate a purpose-built investigation agent needs, and until August 2026 that substrate did not exist as a first-party capability.

For contrast on what such an agent has to do differently: Hesper runs 15+ investigation phases in parallel on every flagged claim, spanning document forensics, OSINT, statement cross-reference, timeline reconstruction and financial pattern analysis, logging every step with its sources, reasoning and timestamps. Set that against the roughly fifteen fields on the ClaimCenter SIU Details screen. One set of fifteen describes an investigation after the fact; the other performs one. Treat the symmetry as illustrative rather than as a benchmark.

For the CIO asking what this does to their Guidewire instance, the answer is deliberately boring. The investigation layer's surface against ClaimCenter is small, read-mostly, and confined to claims that have already been flagged.

• Reads: the flagged claim, its exposures, its parties, and the documents already attached to the file.
• Runs: the investigation outside the core system, against external evidence sources the claims system was never designed to reach.
• Writes: one audit-ready report as an attachment against the existing SIU activity, plus the structured findings a human needs to fill in the outcome fields.
• Does not touch: policy, billing, underwriting, payments, reserves, or the adjuster's screens.
• Does not replace: ClaimCenter, the SIU workplan, or the human sign-off on any disposition.

The paths for that integration already exist and are well-worn. Guidewire's fraud partners have published integrations through the Ready for Guidewire validation program, built with DevConnect in the earlier generation and with Integration Frameworks for Guidewire Cloud in the current one. Shift's claim that its accelerator could cut implementation time by 50 percent is a vendor figure, and it is a useful indicator of what a validated integration path is worth to a carrier's IT calendar compared with a bespoke build.

Hesper is complementary to FRISS, Shift Technology, and Verisk - not a replacement. Where a carrier already runs one of those, Hesper ingests the flag and the reason codes as input and starts working the claim. Where a carrier does not, Hesper has built-in detection and works standalone, which matters for the mid-market carrier who never bought a scoring vendor and whose referrals come from adjuster judgment and configured ClaimCenter rules. The full comparison of what a detection vendor and an investigation layer each own is in our Hesper and Verisk comparison.

For a claims VP, none of the above is an architecture question. It is a loss-cost line and a regulatory exposure. The Coalition Against Insurance Fraud puts US insurance fraud at $308.6 billion a year and reports that fraud occurs in about 10% of property-casualty insurance losses. That 10% is the pool your referral queue is drawing from.

The obligation to work that pool is not optional. The NAIC, on a page last updated 23 June 2026, corroborates the $308.6 billion figure and notes that insurance fraud is a crime in 48 states, with 42 states and the District of Columbia operating insurance fraud bureaus. The Insurance Information Institute describes the standard response: most insurers have established special investigation units staffed with trained investigators including former law enforcement officers, attorneys, accountants and claim experts. That is a headcount answer to a volume problem, and headcount scales linearly while referral volume does not.

The arithmetic underneath those bars is what makes the coverage number stick at roughly a quarter. A manual investigation costs roughly $2,500 per case and 14+ days of an investigator's calendar, and that investigator completes roughly 10 investigations a month while carrying 200+ open cases. No SIU director builds a queue that works every referral under those constraints. The queue gets built the only way it can be: largest exposure first, clearest indicators first, prosecutable cases first. At roughly $150 per case and 2-4 hours instead of 14+ days, the threshold moves and so does the set of claims worth working, taking coverage from roughly 25% of flagged claims to 100% and throughput to 800+ cases per investigator per month. Those are Hesper's internal benchmarks rather than a third-party study, and the mechanism behind them is unit cost, not better detection.

Then go back to that rejection reason on the ClaimCenter screen. Investigation Incomplete is a measurable field in a system 270+ carriers run. Pull the count of referrals rejected with that reason over the last four quarters and you have a defensible internal number for your own coverage gap, sourced from your own system of record rather than from a vendor deck. Under an antifraud plan filed with a state DOI, that number is also the one hardest to explain if it is large and the trend is flat.

Four questions will tell you where your own stack actually stands. All four are answerable from inside your ClaimCenter instance in an afternoon, without a vendor in the room.

1. What produces your fraud score, and is it a configured ClaimCenter rule set, an adjuster's judgment, or a Marketplace partner such as FRISS, Shift, Verisk or Quantexa? Knowing which one you are running determines whether your false-positive problem is a tuning problem or a capacity problem.
2. When a referral is accepted, who does the next 14 days of work, and which of those days are spent gathering evidence versus deciding what the evidence means? The first category is automatable and the second is not.
3. What share of SIU referrals in the last four quarters were rejected with the reason Investigation Incomplete, or your instance's equivalent value? That is your coverage gap in your own data, and it is the number your antifraud plan is implicitly making a claim about.
4. When a state DOI pulls one of those files, does the documented chain reconstruct from referral to finding, with sources and timestamps, or does it reconstruct from a completion date and a disposition code entered by a person after the fact?

The fourth question is the one that separates a records system from an investigation system, and it is the one a compliance officer will ask first. ClaimCenter answers it well for everything it holds. The gap is that most of what it holds about an investigation is the outcome rather than the work. For the wider view of who occupies which layer across the whole fraud stack, our 2026 buyer's guide to AI fraud platforms maps prevention, detection and investigation vendor by vendor.

The referral is captured. The score is captured. The escalation timer runs. The outcome field is captured. ClaimCenter does all of that at the scale of 270+ carriers in more than 30 countries, and it does it well. The work in between the referral and the outcome is the only part of the fraud stack nobody automated, and it is the part where 14+ days, 200+ open cases and a 25% coverage ceiling all come from.