Insurance fraud red flags: 20 indicators every claims team should catch

10%

Of P&C claims involve fraud

Coalition Against Insurance Fraud estimate

$308B

Annual insurance fraud losses globally

Across all lines of business

75%

Of flagged claims never fully investigated

Due to SIU capacity constraints

3-5

Red flags per fraudulent claim on average

Most are caught only after payment

Insurance fraud costs the industry an estimated $308 billion annually, according to the Coalition Against Insurance Fraud. Most carriers have some form of red flag detection in place - whether rule-based scoring, SIU referral criteria, or adjusters trained to "trust their gut." The problem is not that red flags go undetected. The problem is that detection is inconsistent, undocumented, and heavily dependent on individual experience.

A 20-year veteran adjuster spots patterns that a two-year adjuster misses. But that knowledge lives in the veteran's head, not in a system. When they retire - and 40% of the claims workforce is expected to turn over in the next five years - the institutional knowledge goes with them.

This guide provides a structured checklist of 20 fraud indicators across three categories: document anomalies, behavioral signals, and financial patterns. Each indicator is ranked by predictive value based on industry data and Hesper AI's internal analysis of investigated claims.

Why checklists beat gut instinct

Studies in healthcare, aviation, and finance consistently show that structured checklists outperform expert intuition for pattern recognition tasks. Insurance claims are no different. An adjuster processing 150+ claims per month cannot reliably apply the same cognitive attention to claim #147 as to claim #3. Checklists compensate for cognitive load, fatigue, and experience gaps.

More importantly, checklists create documentation. When a claim is flagged based on specific, documented indicators rather than a vague sense that "something feels off," the SIU referral is stronger, the investigation is more focused, and the evidence is more defensible in litigation.

“We implemented a structured red flag checklist and our SIU referral quality improved by 60% in the first quarter. The investigators stopped getting referrals based on hunches and started getting referrals with specific, documented indicators.”
- VP of Claims, mid-size P&C carrier (anonymised)

Document red flags (indicators 1-7)

Document anomalies are the highest-predictive-value indicators because they are objective and verifiable. A document either has pixel-level manipulation or it does not. These indicators do not require judgment calls.

#	Indicator	What to look for	Predictive value
1	Pixel-level manipulation	Compression artifacts, clone stamp patterns, inconsistent noise levels in edited regions	Very high
2	Metadata inconsistencies	Creation dates that don't match claimed dates, mismatched software signatures, stripped EXIF data	High
3	Font inconsistencies	Mixed fonts within a single document, misaligned baselines, kerning irregularities	High
4	Round-number amounts	Repair estimates, medical bills, or loss values in suspiciously round numbers ($5,000.00 exactly)	Medium
5	Template-generated documents	Identical formatting across supposedly independent documents from different providers	High
6	Mismatched document quality	One pristine document submitted alongside degraded copies - suggests the pristine one was recreated	Medium
7	Oversubmission of evidence	Unsolicited submission of excessive supporting documents - overcompensation for a weak claim	Medium

Indicators 1-3 require forensic analysis

Pixel-level manipulation, metadata inconsistencies, and font irregularities are not visible to the human eye in most cases. They require forensic tooling to detect reliably. For more detail on why visual review fails, see why OCR alone isn't enough for document verification.

Behavioral red flags (indicators 8-14)

Behavioral indicators are softer signals. No single behavioral flag is sufficient to warrant an investigation - but two or more in combination with a document flag significantly increase the probability of fraud.

#	Indicator	What to look for	Predictive value
8	Policy inception timing	Loss occurring within 30-90 days of policy inception or a recent coverage increase	High
9	Claim filing delay	Significant delay between the reported loss event and the claim filing, without reasonable explanation	Medium
10	Inconsistent statements	Contradictions between the initial report, recorded statement, and submitted documentation	Very high
11	Coaching indicators	Claimant uses insurance jargon, references specific policy provisions, or provides an unusually rehearsed narrative	Medium
12	Prior claim history	Multiple claims across carriers, frequent policy changes, or a pattern of losses shortly after coverage changes	High
13	Third-party pressure	Attorney involvement before first contact with adjuster, or a public adjuster retained immediately after loss	Medium
14	Unavailability for inspection	Repeated delays or refusals for property inspection, vehicle examination, or independent medical exam	High

Indicator #10 - inconsistent statements - is the single most predictive behavioral flag. When a claimant's initial report contradicts their recorded statement, or either contradicts the submitted documentation, the probability of fraud increases substantially. The challenge is that statement comparison requires careful cross-referencing across multiple documents and recordings, which is time-consuming in manual workflows.

Financial red flags (indicators 15-20)

Financial indicators relate to the economics of the claim - whether the amounts, timing, and circumstances make financial sense.

#	Indicator	What to look for	Predictive value
15	Loss exceeds coverage need	Claimed loss is disproportionately large relative to the claimant's documented assets or lifestyle	High
16	Financial distress	Claimant has recent bankruptcies, liens, foreclosures, or significant debt relative to income	High
17	Premium-to-loss ratio	Total claimed losses across the policy period significantly exceed premiums paid	Medium
18	Inflated repair estimates	Repair or replacement costs substantially above market rates, or inclusion of pre-existing damage	High
19	Provider network anomalies	All services routed through a single provider network, especially if linked to prior fraudulent claims	Very high
20	Duplicate billing patterns	Same services, dates, or amounts appearing across multiple claims or carriers	Very high

Financial red flags are particularly powerful in combination. A claimant in financial distress (indicator #16) who files a claim within 60 days of policy inception (indicator #8) with inflated repair estimates (indicator #18) represents a textbook fraud profile. Any two of these three indicators should trigger an SIU referral.

Combining indicators: the compound signal

No single red flag proves fraud. But fraud rarely presents a single flag. Internal data from Hesper AI investigations shows that confirmed fraudulent claims average 3-5 red flags across categories. The compound signal - multiple indicators from different categories - is what separates genuine claims with unusual characteristics from actual fraud.

Red flag frequency in confirmed fraudulent claims

1 red flag only8%

2 red flags22%

3 red flags35%

4 red flags24%

5+ red flags11%

The most reliable fraud signal is a document anomaly (indicators 1-7) combined with a behavioral flag (indicators 8-14). A claim with pixel-level manipulation in a repair estimate AND a significant filing delay is far more likely to be fraudulent than either indicator alone. This is why automated document forensics paired with structured behavioral checklists outperforms either approach in isolation.

From red flag to investigation

Identifying red flags is only half the problem. The harder half is acting on them. Most carriers flag far more claims than their SIU can investigate - which is why 75% of flagged claims are never fully investigated. The investigation gap means that even a perfect checklist produces limited value if the downstream investigation capacity does not exist.

This is where investigation automation changes the equation. When every flagged claim can be investigated - not just the top 25% - the checklist becomes a direct lever on loss reduction rather than an academic exercise. For more on the investigation gap problem, see why 75% of flagged claims are never fully investigated.

Apply the 20-indicator checklist to every incoming claim - automated scoring is ideal, but even manual application improves consistency
Set a referral threshold: 2+ indicators across different categories triggers SIU review
Document the specific indicators that triggered the referral - this focuses the investigation and creates an evidence trail
Route the claim and its indicators to investigation - either manual SIU or automated investigation via AI agents
Track indicator accuracy over time: which combinations are most predictive for your book of business

Key takeaways

10% of P&C claims involve fraud, costing the industry $308B annually. Most red flags are missed due to inconsistent detection processes.
Document red flags (pixel manipulation, metadata inconsistencies, font mismatches) are the highest-predictive-value indicators because they are objective and verifiable.
Behavioral and financial red flags are softer signals - their value increases dramatically in combination. Confirmed fraud averages 3-5 flags across categories.
The compound signal - document anomaly + behavioral flag - is the most reliable fraud indicator. Either alone produces high false-positive rates.
Checklists only matter if investigation capacity exists downstream. 75% of flagged claims go uninvestigated due to SIU constraints.

For a deep dive into how investigation automation addresses the capacity problem, see how uninvestigated claims drain profitability. For fraud statistics by line of business, see insurance fraud statistics 2026.

Frequently asked questions

The most common red flags fall into three categories: document anomalies (pixel-level manipulation, metadata inconsistencies, font mismatches), behavioral signals (policy inception timing, inconsistent statements, claim filing delays), and financial patterns (financial distress, inflated estimates, provider network anomalies). Confirmed fraudulent claims typically present 3-5 red flags across multiple categories.

Industry best practice is to set the referral threshold at 2 or more indicators from different categories. A single red flag can have innocent explanations, but two indicators from different categories - for example, a document anomaly plus a behavioral signal - significantly increases the probability of fraud. Some carriers use weighted scoring where high-predictive-value indicators (like pixel manipulation or inconsistent statements) can trigger referral on their own.

Document red flags (indicators 1-7) can be fully automated through forensic analysis tools that examine pixel data, metadata, and font rendering. Behavioral and financial red flags (indicators 8-20) can be partially automated through claims data analysis, but some - like statement inconsistencies - require either human review or AI-powered natural language analysis. The most effective systems combine automated document forensics with structured behavioral scoring.

Fraud detection identifies suspicious claims through red flags and scoring. Fraud investigation is the process that follows - gathering evidence, cross-referencing statements, reconstructing timelines, and building a case. Most carriers have adequate detection but insufficient investigation capacity, which is why 75% of flagged claims are never fully investigated. AI investigation agents like Hesper AI address the investigation gap by automating the evidence-gathering and analysis workflow.

Post-payment fraud detection relies on data analytics across the claims portfolio - identifying patterns like duplicate billing, provider network anomalies, and claimant history across carriers. However, post-payment recovery is significantly more expensive and less successful than pre-payment detection. The industry is shifting toward pre-payment investigation, where every flagged claim is investigated before payment is issued.