How insurance companies investigate fraud: inside the SIU process

Insurance fraud investigation is one of the most important and least understood functions in the industry. Policyholders rarely see it. Regulators mandate it. Claims teams depend on it. Yet most carriers struggle to investigate even a quarter of the claims their fraud detection systems flag.

This guide walks through how fraud investigation actually works inside insurance companies - the organisational structure, the investigation workflow, the tools investigators use, and the systemic constraints that limit effectiveness. Whether you are a claims leader evaluating your SIU capacity, an investigator looking to benchmark your process, or a technology vendor trying to understand the workflow you are supporting, this is the reference.

Insurance fraud investigation is mandated by state law, though the form of the mandate varies. States including California, New York, New Jersey and Florida statutorily require carriers to maintain a Special Investigations Unit (SIU); others instead require an antifraud plan or mandatory reporting - New York Insurance Law Section 409 and Regulation 95, for example, require insurers to file a fraud detection and prevention plan with DFS. In practice the function is close to universal: the 2023 Coalition Against Insurance Fraud SIU study found 99% of surveyed carriers run a formal SIU. The mandate exists because insurance fraud is not a victimless crime - it raises premiums for all policyholders, diverts resources from legitimate claims, and in some cases (staged accidents, arson) creates physical danger.

The regulatory framework varies by state, but the core requirement is consistent: carriers must maintain a process for detecting, investigating, and reporting suspected fraud. The National Association of Insurance Commissioners (NAIC) provides model legislation, and most states require carriers to file suspicious activity reports (SARs) when investigations identify probable fraud.

Beyond regulatory compliance, investigation is a direct lever on loss ratio. Every dollar of fraud identified before payment is a dollar preserved. Carriers with effective SIU functions consistently report lower loss ratios than peers - not because they have less fraud, but because they catch more of it.

SIU structure varies significantly by carrier size. Understanding the typical structure helps explain both the capabilities and the constraints.

Even the largest carriers cannot investigate every flagged claim. The 2023 Coalition Against Insurance Fraud SIU study found that 47% of insurers refer 3% or less of their claims to SIU. Take a top-20 carrier processing 1 million claims a year at that 3% rate: 30,000 referrals. Assume 50 investigators who each close about 200 cases a year: roughly 10,000 investigations, a third of referred volume. The other 20,000 are closed without investigation or pushed through abbreviated review that misses complex fraud.

Most SIU teams are organised by line of business (property, auto, workers' comp, liability) or by investigation type (field investigation, desk investigation, digital forensics). Senior investigators handle complex cases involving fraud rings, provider networks, or litigation. Junior investigators handle high-volume desk investigations - primarily document review and database checks. For how a complex ring case is actually worked, phase by phase, see the six-phase staged accident investigation playbook.

While every claim is different, the investigation workflow follows a consistent structure. Understanding these stages reveals both the thoroughness of the process and the points where it is most vulnerable to bottlenecks.

Stage 1: Referral and triage

Investigations begin with a referral - either from an automated fraud scoring system, a claims adjuster who identified red flags, or an external tip (law enforcement, anonymous tip line, other carriers). The SIU manager reviews referrals and assigns cases based on severity, complexity, and investigator availability. High-severity cases (suspected fraud rings, large losses, provider patterns) get priority. Lower-severity cases are often deferred or closed without investigation.

Stage 2: Case planning

The assigned investigator reviews the claim file and develops an investigation plan. This includes identifying what evidence is needed, which databases to check, whether field work (surveillance, witness interviews) is warranted, and what the anticipated timeline is. For complex cases, the investigator may coordinate with external vendors - surveillance firms, forensic accountants, medical peer reviewers. The database step runs on shared industry data, and cross-carrier fraud data networks like ISO ClaimSearch and NICB catch prior-record fraud while missing the first-time kind.

Stage 3: Evidence gathering

The core of the investigation. This stage typically involves:

• Document collection and review - gathering all claim documents, prior claims, policy history
• Database searches - NICB, ISO ClaimSearch, LexisNexis, public records, court filings
• Statement analysis - reviewing recorded statements for inconsistencies, comparing against submitted documentation
• Medical record review - for bodily injury claims, reviewing treatment records against the injury mechanism and timeline
• Financial analysis - bank records, tax returns, asset searches to establish motive or identify financial distress
• Social media and OSINT - publicly available information that may contradict the claim narrative
• Field investigation - surveillance, scene inspection, witness interviews (for high-value cases)

Evidence gathering is the most time-consuming stage. A single complex investigation can require 40-80 hours of investigator time spread across 2-4 weeks. Much of this time is spent on manual document review, waiting for database results, and coordinating with external parties. Specialist data vendors compress individual pulls - Carpe Data and its alternatives deliver human-verified web and social reports in one to four days - but each report is still one more input to order, wait on, and synthesize.

Stage 4: Analysis and findings

The investigator synthesises all collected evidence into findings. This involves constructing a timeline, identifying inconsistencies, evaluating the strength of evidence, and forming a conclusion. The conclusion falls into one of three categories: fraud confirmed (sufficient evidence to support a denial or recovery action), suspicious but insufficient evidence (requires additional investigation or is closed as unsubstantiated), or no fraud indicated (claim is legitimate).

Stage 5: Report generation

The investigator produces a structured report documenting the investigation. This report must be thorough enough to support a claim denial (if fraud is confirmed), withstand regulatory scrutiny, and potentially serve as evidence in litigation or criminal prosecution. The bar that evidence has to clear is the same whether a person or an AI built the file - we work through that test in AI fraud investigation and court admissibility. Reports typically include an executive summary, complete evidence inventory, timeline reconstruction, analysis of inconsistencies, and a recommendation.

Report writing is a significant bottleneck. Investigators are skilled at finding fraud but often struggle with the documentation burden. A comprehensive investigation report can take 4-8 hours to write - time that is not available when an investigator has 200 active cases.

Stage 6: Resolution and reporting

Based on the investigation findings, the claim is resolved. For confirmed fraud, this may involve claim denial, demand for repayment, policy cancellation, and filing a suspicious activity report with the state fraud bureau. For cases referred to law enforcement, the SIU may coordinate with prosecutors and provide testimony. Resolution also includes feedback to the claims team - updating adjuster guidelines based on the fraud patterns identified.

The full spread from the same study, measured from referral acceptance to closure: 47% of surveyed insurers report 21 to 60 days, 12% report 61 days or more, 5% report 20 days or less, and the remaining 36% do not track cycle time (Coalition Against Insurance Fraud, 2023). Most of that elapsed time is waiting, not working. A complex case may need 40 to 80 hours of hands-on investigator work, but those hours are spread across weeks because the investigator is waiting on other people:

1. Records requests. Medical, billing, repair, phone and financial records come from third parties who answer on their own schedule, and many requests need a signed authorization from the claimant first.
2. Recorded statements and EUOs. A recorded statement needs the claimant on the phone. An Examination Under Oath needs the claimant (often with their own counsel), the insurer's attorney, a court reporter and the documents demanded beforehand, all on the same day, and then a transcript.
3. Vendors and databases. Surveillance, medical peer review and scene inspections each go through request, assignment, fieldwork and a written report before the investigator can use them.
4. Caseload. At 200+ open cases per investigator (Hesper benchmark), a new referral can sit in the queue before anyone opens it, and active work happens in slices between other files. A case with a few days of real work can still take weeks to close.

State claim-handling rules set the outer frame. In California, an insurer must acknowledge a claim and begin any necessary investigation within 15 calendar days of notice (10 CCR 2695.5(e)), then accept or deny within 40 calendar days of proof of claim, sending written notice every 30 days if it needs more time (10 CCR 2695.7(b) and (c)(1)). Where the insurer has a documented, reasonable basis to suspect fraud, 10 CCR 2695.7(k) raises that 40 days to 80. The clock can be suspended beyond that only if the insurer has complied with Insurance Code Section 1872.4 and can show the Commissioner it made a diligent attempt to resolve the question within those 80 days. Other states run their own clocks, so the same investigation can face different deadlines depending on where the claim sits.

Automation changes the parts that are work, not the parts that are law or judgment. Evidence gathering, records review, cross-referencing and the written report are what compress: Hesper completes the evidence workup in minutes and hands the investigator a cited evidence package to review. The investigator's judgment, an EUO the claimant has to attend, a third party that has not yet returned records, and any legally required notice or waiting periods do not compress, and should not. The stage-by-stage version of that split - what compresses, what stays human, and why - is mapped in how autonomous AI agents compressed the SIU reporting timeline.

The investigation workflow described above is thorough and effective - when it is applied. The problem is that most carriers can only apply it to a fraction of flagged claims. The breakdown points are systemic, not procedural.

The capacity gap

The most fundamental constraint is headcount. An investigator handling 200 active cases cannot give each case the attention it deserves. The result is triage by severity - only the highest-value or most obviously fraudulent claims receive full investigation. The remaining claims are either closed with abbreviated review or not investigated at all. For a detailed analysis of this problem, see why 75% of flagged claims are never fully investigated.

The documentation burden

Investigators spend an estimated 40-50% of their time on documentation and administrative tasks rather than actual investigation. Report writing, database logging, evidence cataloguing, and regulatory filing consume hours that could be spent on evidence analysis. The documentation burden is a direct trade-off against investigation throughput.

The vendor dependency

Many investigation tasks - surveillance, medical peer review, forensic accounting, scene inspection - are outsourced to external vendors. Vendor coordination adds days to investigation timelines and creates dependency on third-party availability. Each vendor interaction introduces latency: request submission, vendor assignment, fieldwork scheduling, report delivery, and investigator review of vendor findings.

The knowledge retention problem

Senior investigators carry decades of pattern recognition expertise that is not codified in any system. When a 25-year veteran investigator identifies a fraud ring based on subtle provider billing patterns, that recognition is based on experience that cannot be easily transferred. As the claims workforce turns over - and retirement rates in SIU functions are accelerating - institutional knowledge is being lost faster than it can be replaced. The hiring math behind that turnover, and why recruiting alone cannot close the gap, is laid out in our analysis of claims capacity versus adjuster headcount.

The chart above illustrates the problem: investigators spend only 12% of their time on the highest-value activity - analysis and decision-making. The remaining 88% is evidence gathering, report writing, administrative work, and vendor coordination. These are exactly the tasks that benefit most from automation.

AI investigation agents do not replace SIU teams. They address the specific bottlenecks that limit investigation capacity - evidence gathering, document analysis, cross-referencing, and report generation. The investigator's role shifts from performing every investigation task to reviewing AI-generated findings and making final decisions.

The workflow maps directly to the 6-stage process described above, with AI handling stages 2 through 5:

The net effect is a compression from 14+ days to minutes for the investigation itself, with the investigator's time reduced from 40-80 hours of active work to minutes of review. This allows the same SIU team to investigate every flagged claim rather than the current 25%.

The economics shift dramatically: the cost of a manual investigation stops setting the ceiling on how many flagged claims get worked, and the investigation coverage rate goes from 25% to 100%. For the ROI analysis, see how uninvestigated claims drain profitability.

For related content, see insurance fraud red flags: 20 indicators every claims team should catch and insurance fraud statistics 2026: the $308 billion problem.