---
title: "The insurance fraud referral package was never the bottleneck: 51,419 reports in, 243 cases opened"
description: "New York's fraud bureau received 51,419 reports of suspected fraud in 2025 and opened 243 cases. An insurance fraud referral package is an input to a decision, not an outcome."
date: "2026-10-12"
lastModified: "2026-10-12"
author: "Pankaj Dhariwal"
tags: ["Vendor Landscape"]
canonical: "https://gethesperai.com/blog/siu-fraud-referral-package-automation/"
---

# The insurance fraud referral package was never the bottleneck: 51,419 reports in, 243 cases opened

> **TL;DR** Shift Technology shipped a Lead Package Agent on October 1, 2026 that assembles an insurance fraud referral package out of an alert, and it is well-scoped work. What it does not touch is conversion: New York's fraud bureau received 51,419 reports of suspected fraud in 2025 and opened 243 cases, and insurers reported $40.3 million of recoveries against $3.5 billion of claimed savings.
>
> - 51,419 insurance fraud reports in, 243 cases opened, 2025
> - Automated tools: 45% of SIU referrals, 29% of accepted ones
> - $40.3 million recovered against $3.5 billion of claimed savings

- **51,419** - Reports of suspected fraud received by New York's Insurance Frauds Bureau in 2025 (243 cases were opened for investigation in the same year. NY DFS annual report, updated April 15, 2026)
- **45% / 29%** - Automated tools' share of SIU referrals, and their share of accepted referrals (Acceptance ratio 36%, against 70% for adjuster referrals. Coalition Against Insurance Fraud and Aon, 2024 study, 35 P&C carriers)
- **60 days** - Statutory window to pay or deny a Florida property claim, referral or no referral (Fla. Stat. 627.70131(7)(a). California separately allows 60 days from reasonable belief to file the referral, Cal. Ins. Code 1872.4)
- **$40.3M** - Recoveries from SIU investigations New York insurers reported for 2024 (Against $3.5 billion in SIU-attributed savings reported by the same insurers for the same year. Derived: 1.2%)

New York's Insurance Frauds Bureau [received 51,419 reports of suspected fraud in 2025 and opened 243 cases for investigation](https://www.dfs.ny.gov/reports-and-publications/dfs-annual-reports/cpfed-annualrep-2025). Across the five years since 2020, reports received grew 70.8% while cases opened fell 25.0%. The supply of insurance fraud referral packages is compounding, and the capacity to act on them is shrinking. Which means the constraint on a fraud-suspected claim was never how fast the package gets assembled.

That matters this month because the referral package has just become a product category. On October 1, 2026, day three of ITC Vegas, Shift Technology [introduced its Lead Package Agent](https://www.shift-technology.com/resources/reports-and-insights/introducing-shifts-lead-package-agent), which takes an alert something else raised and assembles a referral-ready case package for an investigative team. It is well-scoped, genuinely useful work, and the democratisation argument behind it is correct. A six-person SIU at a regional carrier has never had the scheme knowledge or the data access a national carrier's unit has. An agent that closes that gap is worth buying.

The question a claims or SIU leader has to answer is a different one: what happens to the claim after the package exists. A referral documents suspicion. It does not take the coverage position, move the reserve, schedule the examination under oath, pay, deny, negotiate, defend the decision that follows, or recover a dollar. This post walks the whole path - what the package must legally contain, what Shift's agent does in Shift's own words, why more packages has not produced more cases, why filing one does not pause the statutory clock, and what the recovery numbers say about where the work actually ends. For the handler-assist side of Shift's catalogue, we covered [Shift Claims against autonomous investigation](/blog/shift-claims-agentic-ai-vs-hesper/) separately.

## Where insurance fraud referrals go, and how few come back

**What happens to an insurance fraud referral package after it is filed?**

An insurance fraud referral package is the documented case file a carrier sends to its Special Investigation Unit and, where the facts support it, to a state fraud bureau. New York's bureau received 51,419 of them in 2025 and opened 243 cases for investigation, so roughly one report in 212 became a state investigation.

New York is the conversion series to start with, because it reports both ends of the funnel for the same year. The Department of Financial Services files an annual report on the work of its Insurance Frauds Bureau, and the [current edition, updated April 15, 2026](https://www.dfs.ny.gov/reports-and-publications/dfs-annual-reports/cpfed-annualrep-2025) and submitted by Acting Superintendent Kaitlin Asrow under Section 409(b) of the Financial Services Law, states both numbers plainly: "In 2025, IFB received 51,419 reports of suspected fraud" and "In 2025, IFB opened 243 cases for investigation, affected 169 arrests, and referred 95 cases to prosecutorial agencies for prosecution." That edition does not publish a convictions count or a court-ordered restitution total for 2025, so neither appears here.

Run the division and the funnel is stark. 243 out of 51,419 is 0.47% of reports, about one in 212, that became a state investigation. 95 out of 51,419 is 0.18%, about one in 541, that reached a prosecutor. Both ratios are derived from the bureau's own figures, and both deserve the context the report supplies: "the vast majority" of reports "originated from licensees statutorily required to file reports of suspected insurance fraud with DFS", and approximately 1,400 of the total came from other sources, including non-profit organizations, businesses, consumers and anonymous tips. Approximately 72% of all suspected fraud reports, or 36,835, concerned no-fault automobile insurance, against 57 no-fault cases opened, about one in 646 and also derived. A referral is not a charge, and a bureau that opens 243 cases out of 51,419 reports is not failing at anything. It is behaving like an intelligence intake, which is what it is.

What has changed is the ratio between supply and capacity. In 2020 the bureau received 30,113 reports and opened 324 cases. In 2025 it received 51,419 and opened 243. Reports received grew 70.8%; cases opened fell 25.0%. Both derived, and from two editions: the 2025 figures from Appendix 1 of the current report, which runs 2021 to 2025, and the 2020 baseline from Appendix 1 of the prior edition. Every additional referral filed since 2020 has landed in a system whose throughput shrank by a quarter. That is the fact a referral-automation program runs into, and it is not a criticism of any vendor. It is arithmetic about the receiving end.

> **How to date a New York figure, because two clocks run in this report**
>
> The bureau's own activity is reported for 2025. The insurer-reported savings and recoveries pair is one year in arrears: the edition updated April 15, 2026 carries insurers' figures for 2024, described as the most recent year for which data is available. Quote each to its own year, and to its own edition: Appendix 1 of the current report runs 2021 to 2025, so the 2020 baseline of 324 cases opened comes from the prior edition. Cases opened read 283 in 2021, 279 in 2022, 316 in 2024 and 243 in 2025. We skip 2023, because the report's category total and its summary table disagree on it.

Drawn to a single scale, the 2025 funnel is hard to look at.

| New York Insurance Frauds Bureau, 2025: reports received to prosecutor referrals, drawn to real scale | Value | Share |
| --- | --- | --- |
| Reports of suspected fraud received | 51,419 | 100% |
| Cases opened for investigation | 243 | 0.47% |
| Arrests affected by the bureau | 169 | 0.33% |
| Cases referred to prosecutors | 95 | 0.18% |

The lower three bars are almost invisible because they share a scale with the first one. California corroborates the shape in a second state and a single line of business. For fiscal year 2023-24 the Department of Insurance Fraud Division [received 12,559 suspected fraudulent claims on automobile business and assigned 602 new cases](https://www.insurance.ca.gov/0300-fraud/0100-fraud-division-overview/10-anti-fraud-prog/Automobile.cfm), made 272 arrests and sent 354 cases to prosecuting authorities against $207,629,944 of potential loss. 602 out of 12,559 is 4.8% of suspected fraudulent claims that became an assigned case, and 354 out of 12,559 is 2.8% that reached a prosecutor. Both derived, both an order of magnitude above New York, and both far below the volume of the intake.

For an SIU director the practical reading is this. If a vendor is selling you more referrals, or better ones, the first number to put next to the proposal is what your last thousand referrals produced: how many the unit accepted, how many produced a documented finding, how many changed a payment, and how many returned a dollar. That is a different question from how fast a package can be assembled, and the answer is usually not in the file.

## What an insurance fraud referral package must contain

**What must an insurance fraud referral package contain?**

In California, regulation prescribes the fields: fraud type designation, reporting party information, alleged victim details, policy and claim specifics, loss amounts, a complete factual synopsis and party identifiers, under 10 CCR 2698.37 and 2698.38. California Insurance Code 1872.4 then gives the insurer 60 days from its determination of reasonable belief to file it with the Fraud Division.

An insurance fraud referral package in a P&C claim is a regulated artefact, not a memo whose shape is up to the carrier. California's rules are the most prescriptive of any state, and the text is worth reading closely because it defines the trigger as well as the contents. Under [10 CCR 2698.30](https://insurancefraud.org/regulations/california-siu-requirement-state-insurance-code-section-1875-20-california-code-of-regulations-subchapter-9-insurance-fraud-section-2698-30-et-seq/), a "reasonable belief" is "a level of belief that an act of insurance fraud may have or might be occurring for which there is an objective justification based on articulable fact(s) and rational inferences therefrom", and a Special Investigative Unit is "an insurer's unit or division that is established to investigate suspected insurance fraud".

Read that definition as a specification for an evidence file rather than as legal boilerplate. Objective justification based on articulable facts and rational inferences is exactly what a referral package has to carry, and it is why the regulation also prescribes the fields. 10 CCR 2698.37 and 2698.38 require the fraud type designation, the reporting party, the alleged victim, policy and claim specifics, loss amounts, a complete factual synopsis and identifiers for each party, including contact information, date of birth, social security number, driver's license and vehicle details where relevant. 10 CCR 2698.35 requires the carrier to establish, maintain, distribute and monitor written procedures for how integral anti-fraud personnel identify and refer suspected fraud, and 10 CCR 2698.36 requires the SIU's own written procedures to cover thorough file analysis, witness interviews, database use, evidence preservation and documented investigation summaries.

**Figure 1 (The regulated artefact) - The fields are prescribed, and the clock starts at reasonable belief.** A referral package is not a free-form memo. California sets the trigger, the contents, the form and the deadline.

**The regulated path of one referral**

1. Reasonable belief forms: objective justification from articulable facts
2. The package is assembled with the fields the regulation prescribes
3. Filed with the Fraud Division within 60 days of that determination
4. The state decides whether to open a case of its own

**The California referral, by citation**

- Trigger: reasonable belief of insurance fraud: 10 CCR 2698.30
- Prescribed contents of the referral: 10 CCR 2698.38
- Notice to the state Fraud Division: Within 60 days
- Form the referral is filed on: eFD-1, FD-1, SFC
- Insurers whose reports CDI evaluates each year: About 1,100
- States, plus DC, running an insurance fraud bureau: 42 plus DC

*California is the most prescriptive regime. The last row is the national footprint, counted by the NAIC.*

**The clock:** The 60 days run from the carrier's own determination of reasonable belief, not from the date of loss.

Sources: 10 CCR 2698.30, 2698.38 and 2698.40 via the Coalition Against Insurance Fraud's California SIU regulation page; Cal. Ins. Code 1872.4 for the 60 days after the insurer's determination; California Department of Insurance SIU Compliance Unit page for the eFD-1, FD-1 and SFC forms and the approximately 1,100 insurers whose reports it evaluates each year; NAIC insurance fraud topic page, updated June 23, 2026, for 42 states and the District of Columbia.

### California: a 60-day deadline and a form with a name

The deadline is statutory, not regulatory. [California Insurance Code 1872.4](https://codes.findlaw.com/ca/insurance-code/ins-sect-1872-4/) requires an insurer that determines it has a reasonable belief of fraud to notify the Fraud Division "within 60 days after that determination by the insurer", and the report must carry "the information requested by the form and any additional information relative to the factual circumstances regarding the alleged insurance fraud and person or entity that may have committed or is committing insurance fraud, as specified in Section 2698.38 of Title 10 of the California Code of Regulations". The form has names an SIU will recognise: the Department's [SIU Compliance Unit](https://www.insurance.ca.gov/0300-fraud/0100-fraud-division-overview/12-siu/) describes suspected fraud referrals as "known as eFD-1s, FD-1s, or SFCs", and says its office evaluates "the accuracy, completeness, and timeliness of the report filed by approximately 1,100 insurers each year".

Two other California provisions set the operating tempo around the referral. 10 CCR 2698.39 requires orientation for new employees within 90 days and annual in-service training for integral anti-fraud personnel. 10 CCR 2698.40 requires an SIU annual report within 90 days of the Department's notification, which goes out in June, covering SIU staffing, procedures, personnel qualifications, claims volume, referral statistics and civil fraud actions initiated. Referral statistics are a filed number, which matters before a program starts generating a lot more of them. We walk the whole regime in [our guide to 10 CCR 2698 SIU compliance](/blog/california-10-ccr-2698-siu-compliance/).

### New York: a plan, a full-time unit, and a March 15 report

New York regulates the apparatus rather than the document. Insurance Law section 409 requires insurers writing at least 3,000 individual accident and health, workers' compensation or automobile policies annually in the state, or group policies covering at least 3,000 individuals, to file a Fraud Prevention Plan; HMOs with at least 60,000 enrollees file one too. The plan "must provide for a full-time Special Investigations Unit" and for six named elements: interface of SIU personnel with law enforcement and prosecutorial agencies; coordination with other units of the insurer for investigation and initiation of civil actions; development of a fraud detection and procedures manual; staffing levels and other resources based on objective criteria; in-service training of investigative, claims and underwriting personnel; and a public awareness program.

The [Department's SIU guidance](https://www.dfs.ny.gov/apps_and_licensing/insurance_companies/faqs_fraud_siu) adds structural conditions that bear directly on who can own a referral package: the SIU must be a separate unit with its own budget line, investigative staff cannot perform claims or underwriting duties and vice versa, the unit should not report to claims or underwriting personnel except at executive levels, and the annual report on the plan is due no later than March 15 each year. A tool that compresses referral preparation sits inside that structure, not around it. The filings and the organisational constraints are in [our breakdown of the New York Fraud Prevention Act SIU requirements](/blog/new-york-fraud-prevention-act-siu/).

### The national picture: 42 states and the District of Columbia

Nationally, the [National Association of Insurance Commissioners](https://content.naic.org/insurance-topics/insurance-fraud), on a topic page last updated June 23, 2026, records that "42 states and the District of Columbia operate insurance fraud bureaus that investigate claims of illegal insurance activities", and puts the consumer cost of insurance fraud at $308.6 billion a year, attributing the figure to the Coalition Against Insurance Fraud. The Coalition's own state index confirms named SIU requirements beyond California and New York: New Hampshire RSA 417:30, New Jersey 11:16-6.4 et seq., Kentucky KRS 304.47-080, Maine, and Florida s. 626.9891. A multi-state carrier is therefore running several referral regimes at once, with different triggers and different deadlines, against the same claim file.

## What Shift's Lead Package Agent does, in Shift's words

**What does Shift Technology's Lead Package Agent do?**

Shift Technology's Lead Package Agent, introduced on October 1, 2026, starts from an alert another system already raised and assembles a referral-ready case package for an investigative team to decide on. Shift says it pulls together claims data, public records, credentialing checks and adverse media, and that every finding traces back to its source.

Take the product on its own terms, because the terms are accurate and the scope statement is explicit. Shift writes that the agent "turns a single alert into an expert-ready package in hours instead of weeks", that "what used to take weeks of manual research now comes together in hours", and that "every finding traces back to its source, so the investigator stays fully in control of the decision and the agent simply does the assembling". The stated inputs are "claims data, public records, credentialing checks, and adverse media". The stated start is an alert. The stated end is a referral-ready case package delivered to an investigative team for decision-making.

Concede the democratisation point plainly, because it is the part of that page that matters most to a small unit. Shift writes that with the agent, "no team is left without the fraud scheme knowledge or data access that only the best-resourced SIUs have historically had". That is true, and it is among the most valuable things an agent can do for a six-person SIU. Scheme knowledge has always been distributed unevenly across the industry, and the units that need it most are the ones with the fewest investigators to carry it. An agent that puts credentialing checks and adverse-media scanning in front of a small unit changes what that unit can see.

Record what Shift did not claim on that page, because vendor pages usually claim more. There is no claim of autonomy. There is no claim to resolve or close a claim. There is no number attached to "hours", which is the claim that would be hardest to defend. There is no invocation of autonomy levels or maturity tiers. The page is a scope statement, and a disciplined one.

Three of the claims on that page used to separate vendors and no longer do. Weeks of research compressed into a fraction of the time, per-finding traceability back to a source document, and the human keeping the decision are now table stakes in this category rather than differentiators. That is useful information for a buyer: if two vendors both say all three, those three sentences cannot decide the evaluation, and the evaluation has to move to scope. Our [2026 buyer's guide to AI fraud platforms](/blog/ai-fraud-platforms-compared-2026-pillar/) sorts the category on that basis.

Shift is also not a single-agent company, and any argument that treats it as one is wrong. Its Solutions navigation describes agent lines across most of the claim. Reproducing its own descriptions is the fairest way to show the surface.

| Shift solution line | Shift's own description of it |
| --- | --- |
| Fraud & Risk | "Agents to assess for fraud, automatically assign cases, guide investigations, and autonomously adapt fraud strategies" |
| Coverage & Liability | "Agents to assess policy coverage and liability, potential for agreement, and evidence strength" |
| Subrogation | "Agents to assess subrogation opportunity, create initial demand package, review third party insurer response" |
| Injury | "Agents to assess applicability of medical billing to a claim, estimate medical duration, and develop treatment plan" |
| Process | "Agents to accelerate the claim handling process, mitigate loss, and identify customer satisfaction concerns early" |
| Insurance Data Network | "Agentic intelligence layer that assesses cross-carrier claim history, synthesizes key insights, and recommends relevant next actions" |

So this is not an argument that Shift has nothing downstream of the referral. It plainly does, including a Subrogation agent that creates an initial demand package. The argument is about one agent's scope and about platform architecture, and the clearest statement of that scope is Shift's own. Writing about a social adult day care payment-integrity example on a [companion page dated October 6, 2026](https://www.shift-technology.com/resources/reports-and-insights/taking-on-social-adult-day-care-investigations-with-shifts-lead-package-agent), Shift says: "That transparency keeps the investigator in charge of the decision: the agent handles the assembly, and a senior reviewer still decides what gets referred and how it moves forward." That worked example is a health plan use case rather than US P&C, and the sentence is a scope statement rather than a caveat. The agent's job ends at the decision about what gets referred. Everything after that decision is the rest of this post.

## More packages does not mean more cases

**Do automated fraud referrals get accepted as often as adjuster referrals?**

No. The Coalition Against Insurance Fraud and Aon's 2024 Insurer SIU Benchmarking Study of 35 P&C carriers found automated fraud detection tools generate 45% of all SIU referrals but only 29% of accepted ones. Their acceptance ratio is 36%, against 70% for adjuster referrals, so they convert at roughly half the rate.

Between the package and the case sits an acceptance gate, and the benchmarking data on it is rarely quoted. The [2024 Insurer SIU Benchmarking Study](https://insurancefraud.org/wp-content/uploads/2024-Insurer-SIU-Benchmarking-Study.pdf), run by Aon's Strategy and Technology Benchmarking group with the Coalition Against Insurance Fraud across 35 participating P&C carriers, reports that automated SIU investigative referrals rose by 6 percentage points to 45% of all referrals to SIU, with adjuster referrals dropping to 49%. Then it reports the acceptance side: of accepted referrals, adjusters account for 60%, automated fraud detection tools 29%, and all other sources 10%. The automated share of accepted referrals is up from 21% in the 2022 study, so the trend is real and it is moving in the right direction.

The acceptance ratios are what make the gap legible. The study puts adjuster referral acceptance at 70%, down from 76% in 2022, and the automated-tool acceptance ratio at 36%, up four percentage points from 32%. Multiply the shares by the ratios and the study's own numbers reconcile: 45% of referral volume at a 36% acceptance ratio contributes 16.2% of all referrals as automated and accepted, while 49% at 70% contributes 34.3%. The ratio between those two, 0.47, lands almost exactly on the reported 29 against 60 split of accepted referrals, which is 0.48. Automated referrals are accepted at roughly half the adjuster rate, derived two independent ways from one study.

**Figure 2 (Referral acceptance, 2024 study) - Automated tools send 45% of referrals and win 29% of the acceptances.** A 36% acceptance ratio on 45% of supply lands on the 29% share of accepted referrals the study reports independently.

45% times 36% equals 16.2%

- Automated share of SIU referrals: 45% (Up 6 points since the 2022 study)
- Acceptance ratio, automated tools: 36% (Up from 32% in the 2022 study)
- Share of all referrals, accepted: 16.2% (Adjusters: 49% at 70% gives 34.3%)

**Referral acceptance ratio**

- Adjuster referrals: 70% - Down from 76% in the 2022 study
- Automated fraud detection tools: **36%** - Up from 32% in the 2022 study

**Net effect:** Automated referrals convert into accepted referrals at roughly half the adjuster rate, derived two ways from one study.

Source: Coalition Against Insurance Fraud and Aon, 2024 Insurer SIU Benchmarking Study, September 2024, 35 participating P&C carriers. Referral share and acceptance ratio are separate measures in the study; the product of the two is derived here. Accepted referrals by source are reported as adjusters 60%, automated fraud detection tools 29%, all other sources 10%.

The honest reading of that gap is not that automated referrals are worse. It is that a flag and a case are different objects, and the unit decides which flags become cases on a fixed budget of investigator attention. The same study measures that budget. Annual accepted referrals per investigator rose to 174 from 162 in 2022. Monthly referrals per investigator run 11.6 for field investigators and 17.9 for desk investigators, with desk investigators now carrying 47% of accepted referrals, up from 44% in 2022 and 42% in 2019. Anti-fraud headcount grew 0.5% between 2023 and 2024, down from 1.4% growth in the previous study. SIU budgets sit at about 0.12% of overall premium, down from 0.13%, and carriers averaged 0.67 FTE per $100 million of gross premiums written against 0.9 two years earlier.

Put those together and the receiving end of a referral-automation program is a unit whose staffing per premium dollar has fallen by roughly a quarter in two years while its intake grows. Practitioners have said as much for years, and the quotes read better in the order they were given.

> One of the biggest concerns that SIUs have is they are going to have more cases than they can handle. So it's kind of a chicken or the egg thing.
>
> - Dennis Jay, the retired executive director of the Coalition Against Insurance Fraud, speaking to Insurance Journal, August 25, 2020

The pro-automation counterargument from the same article is the fair one, and it comes from a detection vendor. Dan Gumpright, vice president of global products at FRISS, told [Insurance Journal in August 2020](https://www.insurancejournal.com/news/national/2020/08/25/580280.htm) that acceptance improves with use: "As people deploy these, you start accepting a lot more of the referrals and then you learn what you need to accept over time." He also conceded the trade directly: "I think in general they are going to have a slightly lower acceptance rate but the fraud they are finding will be significant." Brad Barron, a fraud and financial crimes consultant at SAS quoted in the same piece, put the measurement problem in one line: "So it's not just the quantity of referrals, but also the quality that matters." Six years on, the Aon data says the acceptance ratio did improve, from 32% to 36%, and that it is still half the adjuster rate.

One more historical data point deserves a precise date. Shift itself observed in an August 2022 perspective piece that "in 2017, 22% of fraud cases were referred from automated systems - but in 2019, that number was just 15%". Automated referral share has since recovered and passed both figures. The direction is not in dispute. What the data does dispute is the assumption that referral volume and referral quality translate into cases, findings and dollars without something changing at the receiving end. That is the same bottleneck we measured in [why most flagged insurance claims are never fully investigated](/blog/why-flagged-insurance-claims-never-investigated/).

One clarification on numbers, because two different metrics get conflated here. Aon's 174 is accepted referrals per investigator per year. Hesper's internal benchmark of 200+ cases per investigator is open caseload, not accepted referrals, and manual investigation running 14+ days per case is also a Hesper internal benchmark. The two measures are not the same quantity and should not be divided into each other. What the Aon figure does corroborate is the order of magnitude: an investigator's year is measured in low hundreds of files, whichever way you count them.

## A referral does not stop the claim clock

**Does referring a claim to SIU pause the claim's statutory deadlines?**

No. The referral clock and the claim clock run in parallel, not in series. Florida requires an insurer to acknowledge a claim communication within 7 calendar days, begin a reasonably necessary investigation within 7 days of receiving proof-of-loss statements, and pay or deny a property claim within 60 days of notice.

This is the whole argument in one statute. [Florida Statute 627.70131](https://www.flsenate.gov/Laws/Statutes/2024/627.70131) requires an insurer to "within 7 calendar days, review and acknowledge receipt of such communication" from a policyholder, and provides that "within 7 days after an insurer receives proof-of-loss statements, the insurer shall begin such investigation as is reasonably necessary". Subsection (7)(a) is the one that matters here: "Within 60 days after an insurer receives notice of an initial, reopened, or supplemental property insurance claim from a policyholder, the insurer shall pay or deny such claim or a portion of the claim unless the failure to pay is caused by factors beyond the control of the insurer."

Now line that up against the referral deadline. California gives the carrier 60 days from its own determination of reasonable belief to notify the Fraud Division. Florida gives the carrier 60 days from notice of the claim to pay or deny it. Those two clocks start at different events and run at the same time. The referral clock starts when suspicion crystallises, which is usually well after first notice. The disposition clock started at first notice. Filing the referral consumes time on the second clock and buys none.

> **The distinction that decides what a referral tool is worth**
>
> A referral-ready package delivered sooner buys the SIU working time on the investigation. It does not buy the adjuster a single additional day on the coverage position, the reserve or the pay-or-deny decision, because those run on a clock that started at first notice and does not pause for a referral. Both are real gains. Only one of them is the gain most buyers think they are purchasing.

That is why compressing referral preparation and compressing the claim are different purchases. An SIU that gets its package assembled sooner has more days to interview, to pull records and to run an examination under oath before the file has to be resolved. An adjuster whose coverage decision is due in 60 days gains nothing from a faster referral unless the same evidence pass also produces the coverage position, the reserve note and the documented reasoning behind them. We treated the reporting-deadline side of this in [how AI agents compress SIU reporting timelines](/blog/ai-agents-siu-reporting-timeline-compression/).

*Figure: 51,419 reports in. 243 cases opened. Assembly was never the bottleneck.*

## The work that starts the day the package is ready

**What work remains after a fraud referral package is complete?**

The coverage position, the reserve, any examination under oath, the pay, partial-pay, deny or negotiate decision, the defence of that decision, and any recovery. A referral package documents suspicion. None of those six items is produced by it, and all of them sit with the carrier rather than with the state.

The destination of an SIU investigation is a decision about payment, and the person who ran the Coalition Against Insurance Fraud put it more precisely than any vendor page has.

> The best SIU investigation seeks a logical and reasonable explanation for payment of the claim.
>
> - Matthew J. Smith, Esq., Executive Director, Coalition Against Insurance Fraud, writing in CLM Magazine, March 8, 2024

Payment of the claim. Not referral of the claim. Everything between the package and that decision is work somebody has to do, and it is worth itemising, because the itemisation is what a scope conversation needs. The coverage position requires reading the policy and every endorsement against the facts as found, then producing a cited position that will survive a complaint. The reserve has to move, which means a damages estimate defensible to an actuary. An examination under oath has to be scheduled, conducted, transcribed and then read against the rest of the file. We are not attaching a number to how long one takes, because no primary source we trust publishes one, but nobody who has sat through one thinks it is quick. The disposition decision then has to be taken, documented and, if challenged, defended.

The industry has a price for the investigation step alone. The Aon and Coalition study puts the budget expense per investigation at just above $1,200, up about 11% from the 2022 study, with national carriers running roughly 50% below regional carriers on that measure. Average SIU salary came in just under $96,000 against $89,000 in 2022. Field and desk investigators together are roughly three quarters of SIU headcount, and the study records attorneys at 0% of SIU employee distribution, which says something about where the legal work on a contested fraud denial actually happens: not in the unit that produced the referral.

Precision in that downstream work is not an aesthetic preference. Smith, again, on the failure mode that matters most to anyone who has to defend a file.

> My greatest fear in any investigation was getting it wrong. Everyone involved in fighting insurance fraud has the absolute duty to make certain investigations are professional, impartial, and accurate.
>
> - Matthew J. Smith, Esq., Executive Director, Coalition Against Insurance Fraud, writing in CLM Magazine, March 8, 2024

He also makes a vocabulary point an SIU director will recognise and a vendor rarely gets right: "When evidence of insurance fraud is found, though, a claim is never 'denied.' You cannot deny something which they were never entitled to because of their own deliberate acts." The distinction matters because the artefact that supports a rescission, a recoupment or a declination is not the referral package. It is a complete file: the policy language, the material misrepresentation, the payment ledger, the evidence of the deliberate act, and the documented reasoning that connects them. That file is what [our fraud investigation module](/platform/fraud-investigation/) is built to produce, and it is also the thing a manual unit spends most of its 14+ days per case assembling, a Hesper internal benchmark that also frames [the comparison against manual investigation](/compare/hesper-vs-manual-investigation/).

## A fraud finding is not a recovery

**Is a fraud finding the same as a recovery?**

No. New York insurers reported $3.5 billion in SIU-attributed savings for 2024 and $40.3 million in recoveries from SIU investigations in the same filings, so recoveries were 1.2% of claimed savings. Savings means money not paid out. Recovery means money clawed back, and it needs a different evidence package.

The pair of numbers that settles this sits in the same New York report, same year, same population of insurers. In their electronically filed Annual SIU Reports, insurers reported "approximately $3.5 billion in savings and approximately $40.3 million in recoveries from SIU investigations in 2024 (the most recent year for which data is available)". Derived, recoveries were 1.2% of claimed savings. Those are not competing estimates from different studies. They are two lines in the same filings.

**Figure 3 (Savings against recoveries, 2024) - A fraud finding and a recovery are two different evidence packages.** Same report, same year, same insurers: what the industry counts as saved and what it actually got back are different numbers.

**1.2%** - **Recoveries as a share of claimed savings** New York insurers reported approximately $3.5 billion in savings and approximately $40.3 million in recoveries from SIU investigations in 2024, in the same electronically filed Annual SIU Reports.

|  | What it proves | Evidence it must carry | Decision it supports |
| --- | --- | --- | --- |
| Referral package (10 CCR 2698.38 fields) | Reasonable belief of fraud | Claim data, public records, synopsis | What gets referred to the state |
| Recovery package | Entitlement to be paid back | Liability, policy language, ledger | Pursue or waive, and the demand |

**Takeaway:** The referral package proves suspicion. A recovery has to prove entitlement, and that is a different file.

Source: New York DFS Consumer Protection and Financial Enforcement Division annual report, updated April 15, 2026, quoting insurers' electronically filed Annual SIU Reports for 2024, the most recent year for which data is available. The 1.2% is derived from the two reported figures. Referral contents per 10 CCR 2698.38 via the Coalition Against Insurance Fraud's California SIU regulation page.

The criminal track makes the same point at a smaller scale. New York's 51,419 reports in 2025 produced 169 arrests and 95 cases referred to prosecutorial agencies, and the current report publishes no convictions count and no court-ordered restitution total to put beside them. California does publish both. Its District Attorneys' Automobile Insurance Fraud Program, funded at $16,265,714 across 34 counties in fiscal 2023-24, prosecuted 1,036 cases involving 1,111 defendants, obtained 343 convictions and had $1,772,027 of restitution ordered. That is roughly $5,166 per conviction, derived, and ordered is not the same as collected. Restitution is the criminal system's recovery mechanism, and it is small by construction. It was never built to make a carrier whole.

Civil recovery is where the money is, and it needs a different package. A subrogation claim against a third party, a salvage realisation, a fraud-based rescission or a recoupment action all require liability facts, the policy language that creates the right, the payment ledger showing what was actually paid, proof of damages, and a demand a defending adjuster or arbitrator will accept. The referral package proves suspicion. The recovery package proves entitlement. Nothing in a lead package produces the second one, and the industry's recovery numbers show how rarely anyone builds it: [one in four US property-liability insurers records no salvage or subrogation recovery at all](/blog/subrogation-recovery-ai/) in a given year. That is why [every file gets screened for subrogation and salvage](/platform/subrogation-recovery/) rather than the ones somebody remembered to look at.

## Mapping the stages to the tools that cover them

**Which tools cover which stage of a fraud-suspected claim?**

Detection platforms score and flag. Referral-preparation agents assemble the package behind the flag. Evidence layers read the file and answer with citations. Nothing in those three categories of tool takes the coverage position, moves the reserve, settles the claim or files the recovery demand; vendors who do that work sell it as a separate product line.

Laid out stage by stage, the question stops being which vendor is better and becomes how many handoffs a carrier is willing to own. The table below maps the stages of a fraud-suspected claim to categories of tool rather than to feature checkboxes, and each cell says what that category's public materials describe. Where a cell reads "outside the stated scope", that is a statement about one named product's published scope, not a capability judgement about a company.

| Stage of a fraud-suspected claim | What the stage requires | Detection layer: FRISS, Verisk, Shift Fraud & Risk | Shift Lead Package Agent | Hesper AI |
| --- | --- | --- | --- | --- |
| 1. Alert raised | A score or rule fires on a claim | This is the layer: scores and flags | Starts here, from an alert something else raised | Built-in detection, or ingests an existing vendor's flag |
| 2. Referral triage and acceptance | The SIU decides whether the flag is worth a case. Industry acceptance ratio for automated referrals: 36% | Produces the flag and can assign the case; whether to accept it is a human SIU call | Raises the quality of what the SIU sees, so more flags survive triage | Investigates every flag instead of triaging most of them away: about 25% to 100% coverage, a Hesper internal benchmark |
| 3. Package assembly | Claims data, public records, credentialing, adverse media, chronology, factual synopsis, party identifiers (10 CCR 2698.38) | Not this layer | This is the layer: "claims data, public records, credentialing checks, and adverse media" | 15+ investigation phases in parallel, producing an audit-ready file |
| 4. Finding | Somebody concludes what happened and can defend it | A score is not a finding | Shift's words: "a senior reviewer still decides what gets referred and how it moves forward" | A reasoned finding with sources; the investigator keeps decision authority and can override |
| 5. Mandatory report | SFC, FD-1 or eFD-1 within 60 days of reasonable belief (Cal. Ins. Code 1872.4); New York plan report by March 15 | Outside the stated scope | The package is the raw material for the report | Audit-trail native output that feeds the filing |
| 6. Coverage position and reserve | Policy and endorsement reading, reservation of rights, reserve movement | Outside the stated scope | Outside this agent's stated scope | Cited coverage positions, drafted reservation-of-rights letters, reserve recommendations |
| 7. Disposition: pay, partial, deny, negotiate, settle | Runs on its own statutory clock regardless of the referral (Fla. Stat. 627.70131(7)(a): 60 days to pay or deny) | Outside the stated scope | Outside this agent's stated scope | Demand-package digestion, benchmarked valuation, drafted responses, early litigation-risk flags |
| 8. Recovery | Subrogation, salvage, restitution, civil recoupment. New York 2024: $40.3 million recovered against $3.5 billion in claimed savings | Outside the stated scope | Outside this agent's stated scope | Every file screened for subrogation and salvage; demands drafted |

Three footnotes keep that table honest. First, the Shift column is the Lead Package Agent specifically, not Shift Technology: as the solutions table above shows, Shift sells Coverage & Liability, Subrogation, Injury and Process agent lines plus the Insurance Data Network, and its Subrogation agent explicitly creates an initial demand package. Second, "outside the stated scope" is read off public product descriptions, and it is the correct standard to hold any vendor to, including us. Third, the detection column covers three different companies whose materials describe scoring and flagging at and after first notice: FRISS, [Verisk's ISO ClaimSearch](https://www.verisk.com/products/claimsearch/) as a contributory data utility with scoring on top, and Shift's own Fraud & Risk line.

Two categories sit outside the table and belong in the picture. [Owl.co](https://owl.co/solutions) runs an evidence layer on top of the claims system: its products read the file and answer with citations, and monitor eligibility through public records, court filings and social posts, with SIU, subrogation, legal and medical review among its listed use cases and an explicit policy that its AI never denies a claim. Its named production customers are mostly life and disability rather than US P&C. [CCC Intelligent Solutions](https://www.cccis.com/insurance-carriers/subrogation) pairs auto fraud screening built to prioritize work for investigators with dedicated inbound and outbound AI subrogation, including demand generation and evidence packaging. Both are better described as layers than as stages, which is the useful way to read this market: some vendors own a stage, some own a layer across stages, and the carrier assembles the rest.

## One evidence pass, or one product per decision

**Why does platform architecture matter on a fraud-suspected claim?**

Because a fraud-suspected claim needs the same facts six times over: for triage, for the referral, for the coverage position, for the reserve, for the settlement and for the recovery demand. One evidence pass that serves all six is a different architecture from one product per decision, each rebuilding the file it needs.

State the architectural difference plainly, because it is the part a competitor could not restate about itself. On a suspicious claim, the facts that justify the referral are the same facts that decide the coverage position, set the reserve, price the settlement and support the recovery demand: the date and time of loss, the policy and its endorsements, the statements and their inconsistencies, the treating providers and their other files, the prior-loss history, the payment ledger. A platform that runs one investigation-grade evidence pass and then serves all six decisions out of that single sourced, timestamped record is built differently from a set of per-decision products, each of which re-reads the file to produce its own output. On that architecture the referral package is one export of the evidence file rather than the product itself.

That is the claim Hesper is built on, and the supporting figures are internal benchmarks that we label as such. Manual investigation runs 14+ days per case and one investigator carries 200+ cases, which is why about 25% of flagged claims get a real workup and the rest are triaged away by arithmetic rather than by judgement. Running 15+ investigation phases in parallel takes a case to minutes, not weeks, at a fraction of the manual cost, and moves coverage of flagged claims from about 25% to 100%. The point of the coverage number is not throughput for its own sake. It is that the acceptance gate in the Aon data exists because attention is scarce, and a unit that can work up every flag makes the accept-or-decline call on evidence rather than on capacity.

Every claim, first notice to final recovery, with evidence behind every decision. Clean claims resolve straight through; suspicious claims get an investigation-grade workup. In fraud terms that is the move from fraud detection to fraud resolution: the agents assemble, the investigator decides what gets referred and how it moves forward, and the same file then carries the coverage decision, the reserve, the disposition and the recovery screen without being rebuilt three more times. Fraud detection is built in, so Hesper runs standalone, and it is complementary where a carrier already runs FRISS, Shift or Verisk, with their flags coming in and the investigation running on top. The head-to-head view is at [Hesper against Shift Technology](/compare/hesper-vs-shift-technology/).

For an SIU director the practical test of that architecture is not speed. It is whether every finding in the file traces to a source document with a page, a line or a timestamp, whether an investigator can override any conclusion and have the override logged with its reasoning, and whether the same record can be produced for a state DOI examination, a deposition, an examination under oath or a capacity partner's claims audit without being reassembled by hand. That is the standard an SIU gets held to. It should be the standard a vendor gets held to as well.

## What to ask a vendor whose product ends at the referral

**What should you ask a vendor whose product ends at the referral?**

Ask where the agent's scope ends, what happens to its output once the coverage decision is taken, whether the same sourced record carries into the reserve and the settlement, who screens the file for recovery, and what a human has to rebuild by hand at each handoff between products.

None of these questions is a trap, and a well-scoped product should answer all of them without difficulty. They are the questions that turn a demo about assembly speed into an evaluation about the whole claim, and they are worth asking of every vendor in the category, this one included.

1. Where does this agent's scope end, in your own words, and which of our downstream decisions does it not touch? Compare the answer to the public product page, because the page is what we will be held to.
2. When the SIU accepts the referral, what does the next person open: a package, or the same working file with the referral as one export of it?
3. Does the coverage position draw on the same sourced record as the fraud finding, or does somebody read the policy again from the beginning?
4. What happens to the pay-or-deny clock while the referral is being prepared? Show the two timelines side by side on a real file shape.
5. Who screens this file for subrogation and salvage, at what point, and against what evidence? A fraud finding on its own has never returned a dollar.
6. If a state DOI examiner, a deposing attorney or a capacity partner's auditor asks why a decision was taken, what gets handed over, and how much of it has to be rebuilt by hand?

The referral package is a real artefact with prescribed contents, a statutory deadline and a named form, and automating it well is a real contribution to a unit that has never had the data access a national carrier's SIU takes for granted. It is also, on the industry's own primary data, the point at which all but about one New York report in 212 stops being anything at all. Buy the assembly. Then ask what happens on day two.

## Key takeaways

- An insurance fraud referral package in a P&C claim is a regulated artefact: 10 CCR 2698.37 and 2698.38 prescribe its contents, and California Insurance Code 1872.4 gives the carrier 60 days from its determination of reasonable belief to file it.
- New York's Insurance Frauds Bureau received 51,419 reports of suspected fraud in 2025 and opened 243 cases for investigation, so roughly one report in 212 became a state investigation, while reports received grew 70.8% from 2020 as cases opened fell 25.0%.
- Automated tools now generate 45% of all SIU referrals but only 29% of accepted ones, because their acceptance ratio is 36% against 70% for adjuster referrals, which is roughly half the conversion.
- Filing a referral does not stop the claim clock: Florida still requires the insurer to pay or deny a property claim within 60 days of notice under Fla. Stat. 627.70131(7)(a), on a timeline that started before the referral did.
- New York insurers reported $3.5 billion in SIU-attributed savings for 2024 against $40.3 million in recoveries in the same filings, which is why proving suspicion and proving entitlement are two different evidence packages.

## Frequently asked questions

### What is an insurance fraud referral package?

An insurance fraud referral package is the documented case file an adjuster or detection system sends to a carrier's Special Investigation Unit, and that the SIU in turn files with a state fraud bureau, when the facts support a reasonable belief that insurance fraud may have occurred. California defines that trigger at 10 CCR 2698.30 as a level of belief with an objective justification based on articulable facts and rational inferences. The package is not free-form: 10 CCR 2698.37 and 2698.38 require the fraud type designation, the reporting party, the alleged victim, policy and claim specifics, loss amounts, a complete factual synopsis and identifiers for each party. It is an evidentiary artefact, and it is the start of a process rather than the end of one.

### What has to be in an SIU fraud referral, and who writes it?

In California the fields are set by regulation: fraud type, reporting party, alleged victim, policy and claim detail, loss amount, a complete factual synopsis, and party identifiers including contact information, date of birth, social security number, driver's license and vehicle details where relevant, under 10 CCR 2698.37 and 2698.38. In practice the first draft comes from whoever raised the flag. The Coalition Against Insurance Fraud and Aon's 2024 Insurer SIU Benchmarking Study found adjusters still originate 49% of referrals and automated fraud detection tools 45%, with the balance from other sources. The SIU then builds the case file around that referral. Carriers must separately maintain written procedures for how integral anti-fraud personnel identify and refer suspected fraud, under 10 CCR 2698.35.

### When does an insurer have to report suspected insurance fraud to the state?

Deadlines are set state by state, and California's is the most explicit. Insurance Code 1872.4 requires the insurer to notify the Fraud Division within 60 days after its own determination that it has a reasonable belief of fraud, on the form the Department prescribes: the eFD-1, FD-1 or SFC. New York works differently. Insurance Law section 409 requires qualifying insurers to file a Fraud Prevention Plan that provides for a full-time SIU and six named program elements, and to file an annual report on that plan by March 15. The NAIC records that 42 states and the District of Columbia operate insurance fraud bureaus, so a multi-state carrier manages several regimes against the same claim file.

### Does referring a claim to SIU stop the claim clock?

No. The referral clock and the claim clock run in parallel, not in series. Florida Statute 627.70131 requires an insurer to acknowledge a claim communication within 7 calendar days, to begin a reasonably necessary investigation within 7 days of receiving proof-of-loss statements, and under subsection (7)(a) to pay or deny a property claim within 60 days of receiving notice of it. California separately gives the carrier 60 days from its determination of reasonable belief to file the referral. The two clocks start at different events and run at the same time, so a referral that is ready sooner buys the investigative team more working days. It does not buy the adjuster a single extra day on the coverage decision, the reserve or the disposition.

### What happens after a fraud referral is made?

Statistically, very little happens at the state level and almost everything happens back at the carrier. New York's Insurance Frauds Bureau received 51,419 reports of suspected fraud in 2025, opened 243 cases for investigation, affected 169 arrests and referred 95 cases to prosecutorial agencies. That is roughly one investigation opened per 212 reports received. California's Fraud Division received 12,559 suspected fraudulent automobile claims in fiscal 2023-24 and assigned 602 new cases. Meanwhile the carrier still has to take a coverage position, set the reserve, decide whether to pay, partially pay, deny or negotiate, defend that decision if it is challenged, and pursue any recovery. The referral documents the suspicion. It does not resolve the claim.

### Can AI write an insurance fraud referral package, and is that enough?

Yes to the first, and it depends what you needed. Shift Technology's Lead Package Agent, introduced on October 1, 2026, pulls together claims data, public records, credentialing checks and adverse media, and Shift says every finding traces back to its source. That is real, useful work, and Shift is right that it puts scheme knowledge and data access within reach of SIUs that never had them. But the agent begins at an alert something else raised and ends, in Shift's own words, where a senior reviewer still decides what gets referred and how it moves forward. Everything after that decision, from the coverage position and the reserve through the disposition, the settlement and the recovery, is separate work that a referral package does not produce.