Occupancy fraud in property claims: how investigators verify primary residence

Raising an occupancy flag on a property claim costs almost nothing. Proving one takes roughly a dozen separate records, and not one of them answers the question on its own. That asymmetry is why occupancy is among the most frequently flagged and least frequently resolved conditions in a property book.

Occupancy fraud is a misstatement about who lives in an insured dwelling and in what capacity, most often a property written as an owner-occupied primary residence that is actually a rental, a short-term rental, a second home, or vacant. It is material because occupancy is not a rating variable at the margin. It is an eligibility variable that selects the policy form, and some carriers will not write the owner-occupied form on a tenant-occupied or vacant risk at any price.

This post ranks the evidence set by how long each record takes to obtain by hand, puts a number on what a desk review reaches before the adjuster has to decide, and works the cost arithmetic that quietly decides which flags get proven. For the wider map of how prevention, detection and investigation fit together, start with our guide to insurance fraud detection.

One frame before the evidence. Nothing here argues that adjusters are careless or that SIUs are under-motivated. The occupancy workup fails for a structural reason: the records that come back fastest prove the least, the records that carry evidentiary weight take days to weeks, and the decision clock on a property claim does not wait for the second group.

An occupancy flag is a file-level suspicion that the insured does not live at the risk address. It is raised from indicators already sitting in the claim: a mailing address that differs from the risk address, a late-reported loss, a thin contents inventory, utilities in a third party's name. Every one of those is free to spot.

None of them is proof of anything. A mailing address can differ for a dozen innocent reasons. A late report can mean the insured was travelling. A thin contents inventory can mean a minimalist. The indicator tells you where to look; it does not tell you what you found. Occupancy sits in the same family as the other entries on our insurance fraud red flags checklist, and it is the one where the distance between spotting and proving is widest.

The scoring layer widens the gap before it closes it. Rules-based and hybrid scoring runs a 60-85% false positive rate against Hesper's internal benchmarks, which means most of what lands in the referral queue is not fraud and every item still costs something to clear. We covered those mechanics in legacy rules versus autonomous AI fraud detection. Occupancy is a cheap rule to write, so carriers write it, and the queue fills.

The surrounding numbers are large and imprecise, which is normal for this field. The Coalition Against Insurance Fraud puts total US insurance fraud at $308.6 billion a year and reports that fraud occurs in about 10% of property-casualty insurance losses. There is no published figure isolating occupancy fraud inside that share, and any number claiming to be one should be treated with suspicion. Occupancy deserves separate attention because of its shape, not its size.

Detection is upstream; investigation is downstream. An occupancy flag is a detection output: a suspicion, correctly raised, by a system that has done its whole job the moment it raises one. What happens after that is a different discipline with a different cost structure, and the rest of this post is about that discipline.

Occupancy is an eligibility variable rather than a rating factor at the margin. It selects which contract the carrier is willing to issue at all. An owner-occupied homeowners form, a landlord dwelling-fire form, and a vacant-property policy are different products with different perils, different contents treatment, and different underwriting appetite behind them.

The practitioner shape of the difference, stated qualitatively because no authoritative public source puts a defensible number on the differential: an owner-occupied HO-3 carries broad dwelling coverage plus contents and loss of use, priced on the assumption that an owner is on site and notices problems early. A dwelling fire form written on a non-owner-occupied one-to-four family dwelling narrows contents coverage, substitutes fair rental value for loss of use, and treats liability differently. Landlord and rental-dwelling programs are underwritten as tenant-occupied risk, with their own water damage, vandalism and vacancy provisions. Carriers underwrite them as different risks, and some will not write the owner-occupied form on a rental at any price.

That is what makes a misstatement about occupancy material rather than merely inaccurate. New York Insurance Law § 3105 defines a representation as "a statement as to past or present fact, made to the insurer by, or by the authority of, the applicant for insurance or the prospective insured, at or before the making of the insurance contract as an inducement to the making thereof," and then sets the bar in a single sentence: "No misrepresentation shall be deemed material unless knowledge by the insurer of the facts misrepresented would have led to a refusal by the insurer to make such contract." The statute also lets a court consider "evidence of the practice of the insurer which made such contract with respect to the acceptance or rejection of similar risks."

Read that last clause as an evidentiary instruction. Proving materiality is not a matter of asserting that occupancy matters. It requires the carrier's own underwriting practice on comparable risks, produced and documented. That is a second evidentiary burden stacked on top of the first one, which is proving that the insured did not live there.

The stakes per file are ordinary, which is exactly the problem. Homeowners claim severity for 2018-2022, per Insurance Information Institute data sourced to ISO, a Verisk business:

Severity there is accident-year incurred losses excluding loss adjustment expenses, covering HO-2, HO-3, HO-5 and HE-7 forms and excluding tenants, condominium, Alaska, Texas and Puerto Rico. Those five frequencies sum to roughly 4.9 claims per 100 house years, a figure derived from the cause-level rows rather than published as a total, which puts about one in twenty insured homes into a claim in a given year. Water damage and freezing at $13,954 is the denominator for the rest of this post, because it is the modal mid-severity property loss and the place occupancy disputes actually live.

The occupancy evidence set is a reconciliation, not a lookup. Twelve independent records, each proving one narrow fact, assembled into a timeline where they either corroborate each other or contradict each other. The contradictions are the finding. Ranked by manual turnaround, the set inverts: the fastest records prove the least.

Four of the first six are declarations. Voter registration proves a declared civic address. A homestead or property-tax exemption proves that an owner once told a tax assessor where he lived, and exemptions persist after a move until somebody files to remove them. Deed and mortgage records prove ownership and lien position, which is a different question from residence. Social media geotags prove self-reported presence and are trivially staged or backdated.

USPS change-of-address data is the record most often mistaken for proof. NCOALink is, in the Postal Service's own description, "a secure dataset of approximately 160 million permanent change-of-address (COA) records constructed from names and addresses of individuals, families, and businesses who have filed a change-of-address with the Postal Service." It proves that a forwarding order was filed, and when. It does not prove that anyone slept at either address, and it is silent on every move where nobody filed. Retention varies by license class: Full Service Providers receive 48 months of change-of-address data on a weekly cycle, while Limited Service Providers and End User Mailers receive 18 months. A vendor on an 18-month feed returns nothing on a move that happened two years ago, and it returns that as silence rather than as a caveat.

Prior-claims data has the same shape at far greater scale. Verisk ISO ClaimSearch holds roughly 1.8 billion records covering about 95% of the US property-casualty market, with about 175,000 records ingested daily and 200,000 daily users. A ClaimSearch hit returns address history across carriers, which is genuinely useful and is row three of twelve. Scale makes a fast record faster and more complete; it does not upgrade what the record proves. That is the specific version of the general argument in the limits of cross-carrier fraud data networks.

The evidentiary weight sits at the other end of the list. Utility connect, disconnect and usage records prove the meter was live and at what level, which is the closest any record gets to physical presence without a person testifying. School enrollment proves children in a district, is FERPA-constrained, and is rarely obtainable without consent or process. The examination under oath proves sworn testimony on the record with documents compellable under the policy, and it is the slowest step by an order of magnitude.

The turnaround column is a practitioner estimate drawn from SIU practice, not a sourced dataset, and no citation is attached to it because none exists. Real ranges move with the jurisdiction, the utility, whether a subpoena is required, and how cooperative the insured is. Treat the ordering as reliable and the specific day counts as directional.

Two more records come up constantly and sit deliberately outside the twelve. Employment and payroll records prove an employer-of-record address rather than a residence, typically take one to three weeks, and usually need a subpoena or a signed authorization. A recorded statement is fast and useful, but it is unsworn; its value is as a baseline to contradict later, not as proof of occupancy. Neither belongs in the evidence set as a proof source. Both belong in the file.

The one record that expires

Row seven is the anomaly. A rental or short-term-rental listing for the risk address can be captured in hours and is gone permanently once the insured deletes it. It is the only item on the list where the clock runs against the carrier from the moment of loss rather than from the moment of assignment. Cached copies and archive services sometimes hold a snapshot and sometimes do not. Everything else can be obtained late. This one cannot be obtained at all, which is why it belongs in the first hour of any file carrying an occupancy indicator, ahead of records that look more important.

A desk review is what an adjuster can obtain without a subpoena, a field canvass, or counsel. On an occupancy file that reaches two to four of the twelve signals before the decision clock runs out, or 17% to 33% of the evidence set. The number that matters is the eight to ten that never arrive.

Both figures are practitioner estimates rather than published benchmarks, and the exact count moves with the state, the carrier's authority thresholds, and whether the adjuster has a vendor on retainer. The shape does not move. The signals reachable from a desk are the same six at the top of the table, and those six prove a declaration rather than a presence.

The constraint is arithmetic, not diligence. A manual SIU investigation runs 14+ days per case, and an investigator carrying 200+ open cases cannot spend fourteen of them on a mid-severity water claim with one occupancy indicator. So the file gets a partial workup and a decision. Roughly 25% of flagged claims receive a full manual investigation; the remainder are paid, denied without complete work, or queued until they age out. Occupancy flags are the archetype of that category, for the reason we set out in why most flagged claims are never investigated: cheap to raise, expensive to prove, easy to defer.

The failure is invisible in the file. A claim paid on incomplete occupancy evidence looks identical to a claim paid on complete occupancy evidence. There is no disposition code for running out of clock. That is what makes the coverage gap durable: it produces no metric anybody is accountable for, and it never shows up in the SIU hit rate because the file never became an SIU case.

The occupancy workup sits inside the standard sequence described in how insurance companies investigate fraud, and it stalls in the same place every time: the transition from records that arrive on their own to records somebody has to request, chase and wait for.

A full manual occupancy workup costs roughly $2,500 per investigated case against Hesper's internal benchmarks. Measured against average homeowners claim severity, that is about 18% of a water damage and freezing claim, close to half of a theft claim, and about 3% of a fire loss. The economics, not the investigator, decide which flags get proven.

Those percentages are derived by dividing the ~$2,500 internal benchmark by the Insurance Information Institute severity figures above. The benchmark is Hesper's own rather than an industry average, and it covers a complete workup: records, vendor fees, canvass and investigator hours through to a documented finding, not a partial desk review.

Read the top and bottom of that chart together. At fire-loss severity a full occupancy verification is a rounding error and every carrier authorizes it. At theft severity it costs half the claim, and no claims manager signs that off. Water and wind, the two highest-frequency causes at 1.61 and 2.82 claims per 100 house years, sit at roughly 18% each, which is the awkward middle: too expensive to spend routinely, too cheap to be obviously wrong.

So the work does not happen, the flag does not get resolved, and the claim gets paid. That is not leakage caused by a bad decision. It is leakage caused by a correct decision under a cost structure that makes the right answer unaffordable, which is the pattern we traced across the whole book in reducing claims leakage.

The other row of the same arithmetic: at Hesper's internal benchmark of roughly $150 per investigated case, the same verification against the same $13,954 water claim is about 1%. Both figures are internal benchmarks rather than published industry data, and the ratio is the point rather than either number on its own. At 18% of claim value, verification is a budget approval that somebody has to justify. At 1%, it is a default that nobody has to argue for.

Running the evidence set concurrently means issuing all twelve record requests at once and reconciling the returns as a set, instead of working down a queue one lookup at a time. The first-order effect is coverage, not speed: the same twelve records, on every flagged file, with none of them skipped because attention ran out.

The reason a manual occupancy workup takes weeks is not that any single lookup is slow. Most of them are not. It is that a human investigator's attention is the serialization point. Twelve requests issued by one person carrying 200+ cases go out over days, each waiting behind the last, and the reconciliation cannot begin until enough of them have landed. Hesper runs 15+ investigation phases in parallel on every flagged claim, which for an occupancy file means the record-gathering set is issued as one concurrent batch rather than a queue. The mechanics are in parallel processing across SIU investigation phases.

The consequence that matters to a claims leader is the coverage number rather than the clock. Moving from ~25% to 100% of flagged claims fully investigated is a fourfold change in how much of the flagged book gets resolved, and it lands hardest on exactly the category described here: flags that were always going to be deferred because proving them cost more than the claim justified. Make every flagged claim investigable. Hours, not weeks.

Be precise about what does not compress. An examination under oath still requires scheduling, counsel and a court reporter, and none of that is a software problem. A neighborhood canvass still requires somebody standing on a doorstep. A FERPA-protected school record still requires consent or process. Parallelism collapses the record-gathering tail, which is where the weeks actually go. It does not collapse the sworn-testimony step and it does not shorten a subpoena return.

This is a layer distinction, not a vendor argument. Prevention-layer data vendors verify occupancy at underwriting time, before the policy binds, and that work is worth doing. What it cannot do is prove occupancy at the date of loss, because occupancy is not a static attribute. It changes silently between bind and loss, and a property claim only ever asks about the second date. Detection vendors such as FRISS and Shift Technology raise the flag well and hand the proof to a human, which is the correct terminus for a scoring product. From fraud detection to fraud resolution is the distance in between.

One more distinction worth holding, because vendors blur it. A platform that lets an investigator order twelve record pulls has not compressed anything if the twelve still return serially into the same human queue. Ordering an investigation is not running one, which is the argument we made at length in our review of Carpe Data alternatives. The test is whether the output is a stack of returns or a reconciled finding with the contradictions already surfaced and sourced.

Rescission and claim denial are different remedies with different standards. Rescission attacks the contract from inception and turns on a material misrepresentation made at application or renewal. Denial attacks one claim and usually turns on the policy's concealment or fraud condition, which in most states requires intentional misrepresentation of a material fact.

California draws the sharpest version of the rescission line. California Insurance Code § 331 reads, in full: "Concealment, whether intentional or unintentional, entitles the injured party to rescind insurance." There is no intent element. An applicant who sincerely believed a rental was his primary residence and was wrong has still concealed.

The claim-stage statute is a separate track. California Penal Code § 550(a)(1) makes it unlawful to "Knowingly present or cause to be presented any false or fraudulent claim for the payment of a loss or injury, including payment of a loss or injury under a contract of insurance," and subsection (b) reaches false or misleading statements of material fact made to an insurer and the concealment of events affecting benefits. Contract-stage remedy and claim-stage offense are different questions, and an occupancy file can end on either, both, or neither.

The worked example is Homesite Insurance Company v. Jiang, No. CV-21-00554-TUC-JGZ (D. Ariz. Sept. 16, 2024). The insured represented a Tucson property as his primary residence. The home had been vacant since a 2014 foreclosure. After a March 2020 vandalism loss reported roughly seven months late, the carrier established non-occupancy through neighbor testimony, police reports and the reporting delay, and the court granted rescission on the ground that the misrepresentation was material because Homesite does not underwrite vacant properties. IRMI's expert commentary on the decision is the reader-accessible write-up.

Read the evidence list in that sentence again, because it is this post's thesis appearing in a courtroom. Neighbor testimony. Police reports. A seven-month reporting delay. Not a database hit. The carrier prevailed because it assembled a record set and reconciled it, and the record set is what the court weighed.

Whichever path a carrier takes, the file has to show its work. A rescission decision that cannot be reconstructed - which sources were consulted, in what order, what each returned, and what the investigator concluded from the combination - is a decision that gets tested twice, once by the insured's counsel and once by a market conduct examiner. Hesper's investigation record is audit-trail-native for that reason: every phase logs its sources, its reasoning and its timestamps as it runs, rather than being reconstructed afterward from memory. What that output has to contain is covered in the audit-ready fraud report.

Four failure modes account for most occupancy files that collapse: treating a same-day record as proof, losing the perishable rental listing, letting one access constraint stall the entire workup, and taking the examination under oath before the record set is assembled. All four are sequencing errors rather than effort errors.

1. Treating a declaration as a finding. A voter registration, a homestead exemption or a ClaimSearch address history at a second property is a reason to keep working, not a conclusion. Files built on the fast tier alone lose on cross-examination, because every one of those records answers a question the insured was never asked under oath. The working rule: if a record can be explained by paperwork inertia, it is not proof.
2. Losing the listing. A rental or short-term-rental advertisement for the risk address is the fastest evidence to capture and the only piece that can vanish permanently. It should be pulled and preserved in the first hour of any file carrying an occupancy indicator, as a timestamped capture rather than a link, because a link to a deleted listing proves nothing at all.
3. Letting one constraint stall twelve requests. DMV records are restricted under the Driver's Privacy Protection Act. School enrollment is FERPA-constrained and usually needs consent or process. A serial workup stops at the first blocked request and waits, which turns a two-week file into a six-week file. A concurrent workup routes around it: the blocked request runs on its own track while the other eleven return.
4. Taking the EUO too early. The examination under oath is the strongest tool in an occupancy dispute and it is close to a one-shot instrument. Taken before the utility records, DMV address and canvass are in hand, it produces a version of events with nothing to contradict it. Taken after, it either locks a consistent account or puts contradictions on the record. Assemble first, examine second.

None of these is a knowledge gap. Every experienced investigator knows all four. They happen because a serial workup forces constant choices about what to do first with finite attention, and the correct sequence is expensive to hold when twelve requests are competing for one person's day.