Insurance fraud investigation is one of the most important and least understood functions in the industry. Policyholders rarely see it. Regulators mandate it. Claims teams depend on it. Yet most carriers struggle to investigate even a quarter of the claims their fraud detection systems flag.
This guide walks through how fraud investigation actually works inside insurance companies - the organisational structure, the investigation workflow, the tools investigators use, and the systemic constraints that limit effectiveness. Whether you are a claims leader evaluating your SIU capacity, an investigator looking to benchmark your process, or a technology vendor trying to understand the workflow you are supporting, this is the reference.
Why fraud investigation exists
Every state in the US requires insurance companies to have a Special Investigations Unit (SIU) or equivalent function. The mandate exists because insurance fraud is not a victimless crime - it raises premiums for all policyholders, diverts resources from legitimate claims, and in some cases (staged accidents, arson) creates physical danger.
The regulatory framework varies by state, but the core requirement is consistent: carriers must maintain a process for detecting, investigating, and reporting suspected fraud. The National Association of Insurance Commissioners (NAIC) provides model legislation, and most states require carriers to file suspicious activity reports (SARs) when investigations identify probable fraud.
Beyond regulatory compliance, investigation is a direct lever on loss ratio. Every dollar of fraud identified before payment is a dollar preserved. Carriers with effective SIU functions consistently report lower loss ratios than peers - not because they have less fraud, but because they catch more of it.
How SIU teams are structured
SIU structure varies significantly by carrier size. Understanding the typical structure helps explain both the capabilities and the constraints.
Even the largest carriers cannot investigate every flagged claim. A top-20 carrier processing 1 million claims annually with a 10% fraud flag rate generates 100,000 referrals per year. With 50 investigators handling 200 cases each, they can complete approximately 10,000 investigations - 10% of flagged volume. The remaining 90,000 flagged claims are either closed without investigation or handled through abbreviated review processes that miss complex fraud.
Most SIU teams are organised by line of business (property, auto, workers' comp, liability) or by investigation type (field investigation, desk investigation, digital forensics). Senior investigators handle complex cases involving fraud rings, provider networks, or litigation. Junior investigators handle high-volume desk investigations - primarily document review and database checks.
The 6 stages of a fraud investigation
While every claim is different, the investigation workflow follows a consistent structure. Understanding these stages reveals both the thoroughness of the process and the points where it is most vulnerable to bottlenecks.
Stage 1: Referral and triage
Investigations begin with a referral - either from an automated fraud scoring system, a claims adjuster who identified red flags, or an external tip (law enforcement, anonymous tip line, other carriers). The SIU manager reviews referrals and assigns cases based on severity, complexity, and investigator availability. High-severity cases (suspected fraud rings, large losses, provider patterns) get priority. Lower-severity cases are often deferred or closed without investigation.
Stage 2: Case planning
The assigned investigator reviews the claim file and develops an investigation plan. This includes identifying what evidence is needed, which databases to check, whether field work (surveillance, witness interviews) is warranted, and what the anticipated timeline is. For complex cases, the investigator may coordinate with external vendors - surveillance firms, forensic accountants, medical peer reviewers.
Stage 3: Evidence gathering
The core of the investigation. This stage typically involves:
- Document collection and review - gathering all claim documents, prior claims, policy history
- Database searches - NICB, ISO ClaimSearch, LexisNexis, public records, court filings
- Statement analysis - reviewing recorded statements for inconsistencies, comparing against submitted documentation
- Medical record review - for bodily injury claims, reviewing treatment records against the injury mechanism and timeline
- Financial analysis - bank records, tax returns, asset searches to establish motive or identify financial distress
- Social media and OSINT - publicly available information that may contradict the claim narrative
- Field investigation - surveillance, scene inspection, witness interviews (for high-value cases)
Evidence gathering is the most time-consuming stage. A single complex investigation can require 40-80 hours of investigator time spread across 2-4 weeks. Much of this time is spent on manual document review, waiting for database results, and coordinating with external parties.
Stage 4: Analysis and findings
The investigator synthesises all collected evidence into findings. This involves constructing a timeline, identifying inconsistencies, evaluating the strength of evidence, and forming a conclusion. The conclusion falls into one of three categories: fraud confirmed (sufficient evidence to support a denial or recovery action), suspicious but insufficient evidence (requires additional investigation or is closed as unsubstantiated), or no fraud indicated (claim is legitimate).
Stage 5: Report generation
The investigator produces a structured report documenting the investigation. This report must be thorough enough to support a claim denial (if fraud is confirmed), withstand regulatory scrutiny, and potentially serve as evidence in litigation or criminal prosecution. Reports typically include an executive summary, complete evidence inventory, timeline reconstruction, analysis of inconsistencies, and a recommendation.
Report writing is a significant bottleneck. Investigators are skilled at finding fraud but often struggle with the documentation burden. A comprehensive investigation report can take 4-8 hours to write - time that is not available when an investigator has 200 active cases.
Stage 6: Resolution and reporting
Based on the investigation findings, the claim is resolved. For confirmed fraud, this may involve claim denial, demand for repayment, policy cancellation, and filing a suspicious activity report with the state fraud bureau. For cases referred to law enforcement, the SIU may coordinate with prosecutors and provide testimony. Resolution also includes feedback to the claims team - updating adjuster guidelines based on the fraud patterns identified.
The investigation timeline
End-to-end, a manual fraud investigation takes 14+ days for a standard case and can extend to 60+ days for complex cases involving fraud rings, multiple jurisdictions, or provider networks. The evidence-gathering stage alone typically consumes 60-70% of total investigation time.
Where the process breaks down
The investigation workflow described above is thorough and effective - when it is applied. The problem is that most carriers can only apply it to a fraction of flagged claims. The breakdown points are systemic, not procedural.
The capacity gap
The most fundamental constraint is headcount. An investigator handling 200 active cases cannot give each case the attention it deserves. The result is triage by severity - only the highest-value or most obviously fraudulent claims receive full investigation. The remaining claims are either closed with abbreviated review or not investigated at all. For a detailed analysis of this problem, see why 75% of flagged claims are never fully investigated.
The documentation burden
Investigators spend an estimated 40-50% of their time on documentation and administrative tasks rather than actual investigation. Report writing, database logging, evidence cataloguing, and regulatory filing consume hours that could be spent on evidence analysis. The documentation burden is a direct trade-off against investigation throughput.
The vendor dependency
Many investigation tasks - surveillance, medical peer review, forensic accounting, scene inspection - are outsourced to external vendors. Vendor coordination adds days to investigation timelines and creates dependency on third-party availability. Each vendor interaction introduces latency: request submission, vendor assignment, fieldwork scheduling, report delivery, and investigator review of vendor findings.
The knowledge retention problem
Senior investigators carry decades of pattern recognition expertise that is not codified in any system. When a 25-year veteran investigator identifies a fraud ring based on subtle provider billing patterns, that recognition is based on experience that cannot be easily transferred. As the claims workforce turns over - and retirement rates in SIU functions are accelerating - institutional knowledge is being lost faster than it can be replaced.
How investigators spend their time (average)
The chart above illustrates the problem: investigators spend only 12% of their time on the highest-value activity - analysis and decision-making. The remaining 88% is evidence gathering, report writing, administrative work, and vendor coordination. These are exactly the tasks that benefit most from automation.
How AI is changing the investigation process
AI investigation agents do not replace SIU teams. They address the specific bottlenecks that limit investigation capacity - evidence gathering, document analysis, cross-referencing, and report generation. The investigator's role shifts from performing every investigation task to reviewing AI-generated findings and making final decisions.
The workflow maps directly to the 6-stage process described above, with AI handling stages 2 through 5:
The net effect is a compression from 14+ days to 2-4 hours for the investigation itself, with the investigator's time reduced from 40-80 hours of active work to 30-60 minutes of review. This allows the same SIU team to investigate every flagged claim rather than the current 25%.
The economics shift dramatically: per-investigation cost drops from approximately $2,500 (manual) to approximately $150 (AI-assisted), and the investigation coverage rate goes from 25% to 100%. For the ROI analysis, see how uninvestigated claims drain profitability.
Key takeaways
- Every US state requires carriers to maintain an SIU function. Effective investigation directly reduces loss ratios.
- The standard investigation has 6 stages: referral, planning, evidence gathering, analysis, reporting, and resolution. End-to-end takes 14+ days.
- Most carriers can only investigate 25% of flagged claims. The constraint is investigator capacity - 1 investigator per 200+ cases.
- Investigators spend 88% of their time on evidence gathering, report writing, and administrative tasks. Only 12% goes to analysis and decision-making.
- AI investigation agents compress the evidence-to-report workflow from 14+ days to 2-4 hours, enabling 100% investigation coverage at ~$150 per case vs. ~$2,500 manually.
For related content, see insurance fraud red flags: 20 indicators every claims team should catch and insurance fraud statistics 2026: the $308 billion problem.